CVE-2026-77405

Prior to version 1.13.0, the tlsConfigFromURI function in uri.go of RabbitMQ's amqp091-go library builds tls.Config objects without setting MinVersion to tls.VersionTLS12. When an application connects through an amqps URI on a build whose Go runtime defaults still permit TLS 1.0 or TLS 1.1, the AMQP-over-TLS connection can negotiate an obsolete protocol version. A network attacker able to influence TLS negotiation against such a legacy build can weaken transport protection, exposing AMQP message contents and broker credentials to reduced confidentiality and integrity. Only applications embedding this Go client library under those conditions are affected; the flaw is fixed in version 1.13.0. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA KEV, though its CVSS 4.0 score of 9.4 is critical (with high attack complexity and a prerequisite vulnerable configuration).

What to do: Upgrade amqp091-go to version 1.13.0 or later. As an interim mitigation, explicitly set tls.Config MinVersion to tls.VersionTLS12 (or higher) in application code and build with a Go toolchain whose TLS defaults already enforce TLS 1.2+. Audit whether your services connect via amqps URIs that rely on tlsConfigFromURI, since those are the affected code paths.