CVE-2026-77405
Description
A flaw was found in RabbitMQ amqp091-go. The tlsConfigFromURI helper creates tls.Config values for amqps:// URIs without setting MinVersion. When the client is built with a Go toolchain whose default still permits TLS 1.0 or TLS 1.1, a network attacker who can influence TLS negotiation may force an obsolete protocol version and weaken protection of AMQP messages and credentials. The issue is fixed in amqp091-go 1.13.0 by requiring TLS 1.2 as the minimum.
Statement
This flaw has an Important impact. Red Hat product streams that ship amqp091-go before 1.13.0 are Affected because tlsConfigFromURI does not set an explicit TLS MinVersion when parsing AMQPS URIs. Exploitation requires a man-in-the-middle position on the path to the AMQP broker; Go 1.18 or later client defaults further raise complexity by preferring TLS 1.2 when MinVersion is unset. Streams that already ship amqp091-go 1.13.0 or later contain the explicit fix and are Not affected. The issue is not Critical because it is not remotely exploitable without those high-complexity prerequisites, and it does not provide unauthenticated remote code execution.
Mitigation
Ensure clients are built with Go 1.18 or later so the TLS client default is at least TLS 1.2. Restrict AMQP clients to trusted brokers and limit broker network exposure. If using DialTLS with a custom tls.Config, set MinVersion to tls.VersionTLS12 or higher explicitly.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
An attacker may be able to decrypt the data using brute force attacks. The attacker may have a reasonable chance of succeeding using current attack methods and resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
