CVE-2026-77405

The record

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.

Affected packages

Related vulnerabilities

• CVE-2026-41860 CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA… CWE-326
• CVE-2026-8878 Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible… CWE-326
• CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. CWE-326
• CVE-2026-45363 ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351 CWE-326
• GHSA-g29v-q6h7-76wh electerm's encrypt method not safe enough CWE-326
• CVE-2026-44523 Note Mark is an open-source note-taking application. CWE-326
• GHSA-gxhx-2686-5h9g slack-go `SecretsVerifier` accepts empty signing secret without precondition CWE-326
• CVE-2026-44351 fast-jwt provides fast JSON Web Token (JWT) implementation. CWE-326