Summary
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
A structural security weakness exists in the AMQP client's TLS configuration generator (tlsConfigFromURI). When constructing a *tls.Config object from an amqps:// connection URI, the library initializes the structure without explicitly defining the MinVersion field.
While modern versions of the Go compiler toolchain (Go 1.18+) default the implicit minimum version to TLS 1.2, this security posture relies entirely on an implicit toolchain dependency. If the library is compiled using legacy Go toolchains (Go < 1.18), or if a future toolchain introduces fallback behavior, the client could silently negotiate obsolete and insecure TLS 1.0 or TLS 1.1 protocols during connection handshakes with a compromised or malicious AMQP broker.
Vulnerability Details
Mechanism
The vulnerability lies in the lack of an explicit safety floor when assigning configurations inside the URI component:
// Example within uri.go's tlsConfigFromURI
cfg := &tls.Config{
ServerName: host,
// MinVersion is left completely unassigned (defaults to 0, or toolchain default)
}
In the Go standard library (crypto/tls), leaving MinVersion: 0 instructs the runtime to choose the toolchain's default minimum. Prior to Go 1.18, this default allowed negotiation down to TLS 1.0. Relying on implicit compiler configurations violates secure coding practices by decoupling the library's security posture from its source code, leaving applications vulnerable based solely on how they are built.
Attack Vector
An attacker performing a network-level downgrade attack can intercept a client connection built under a legacy toolchain:
- Interception: A client application compiled on a legacy pipeline attempts to establish an encrypted connection to an AMQP broker.
- Protocol Downgrade: The attacker intercepts the TLS Client Hello handshake and forces a downgrade negotiation to TLS 1.0.
- Cryptographic Exploitation: Because
MinVersionwas never explicitly locked totls.VersionTLS12by the library, the client accepts the weak cipher suites, allowing the attacker to monitor or manipulate the underlying AMQP session data.
Impact
If a client application is built with a legacy compiler environment or a custom Go runtime, an attacker capable of executing a Man-in-the-Middle (MitM) attack can force the connection to downgrade to TLS 1.0 or 1.1. This exposes the AMQP protocol data stream to well-known cryptographic vulnerabilities (such as BEAST, POODLE, or SWEET32), allowing the attacker to decrypt or alter message payloads, connection parameters, and authentication credentials.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-77405? CVE-2026-77405 is a critical-severity security vulnerability in github.com/rabbitmq/amqp091-go (go), affecting versions < 1.13.0. It is fixed in 1.13.0.
- Which versions of github.com/rabbitmq/amqp091-go are affected by CVE-2026-77405? github.com/rabbitmq/amqp091-go (go) versions < 1.13.0 is affected.
- Is there a fix for CVE-2026-77405? Yes. CVE-2026-77405 is fixed in 1.13.0. Upgrade to this version or later.
- Is CVE-2026-77405 exploitable, and should I be worried? Whether CVE-2026-77405 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-77405 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-77405? Upgrade
github.com/rabbitmq/amqp091-goto 1.13.0 or later.