RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
Priority MEDIUM 48CWE-326Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-326.
Summary
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix Partial amqp091-go (rabbitmq): 1.13.0github.com/rabbitmq/amqp091-go (Go): 1.13.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rabbitmq | amqp091-go | before 1.13.0 | 1.13.0 | Patch available | CNA |
| — | github.com/rabbitmq/amqp091-go (Go) | before 1.13.0 | 1.13.0 | Patch available | GHSA-33mj-cw25-m34h |
- amqp091-go Vendorrabbitmq Affected before 1.13.0 Fixed in 1.13.0 Patch available CNA
- github.com/rabbitmq/amqp091-go (Go) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-33mj-cw25-m34h
Remediation
- Fix · CNA amqp091-go (rabbitmq) Fixed in 1.13.0
- Fix · GHSA-33mj-cw25-m34h github.com/rabbitmq/amqp091-go (Go) Fixed in 1.13.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:95517 Released 2026-11-05 · Red Hat rating ImportantMulticluster Global Hub 1.7.4 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:92307 Released 2026-10-29 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:95517 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:92307 |
Not affected: 7 products
- Custom Metric Autoscaler operator for Red Hat Openshift
- Multicluster Global Hub 1.7.4
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Hardened Images
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77405
- 2026-10-03 Alias added: GHSA-33mj-cw25-m34h
- 2026-10-10 Affected versions changed · Red Hat
- 2026-10-10 CVSS score added · Red Hat
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-24 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
- 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95517 · Red Hat
References
Other 5
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h
- https://github.com/rabbitmq/amqp091-go/pull/355
- https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
- https://github.com/rabbitmq/amqp091-go
More rabbitmq vulnerabilities
- TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
- TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
- TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
- TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
- TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
- TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
Sources
- CVE-2026-77405 · CVE Program
- CVE-2026-77405 · NVD
- FIRST EPSS
- GHSA-33mj-cw25-m34h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-77405 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences