CVE-2026-77405

Name	CVE-2026-77405
Description	RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-rabbitmq-amqp091-go (PTS)	bookworm	1.5.0-2	vulnerable
	trixie	1.10.0-1	vulnerable
	forky, sid	1.15.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-rabbitmq-amqp091-go	source	(unstable)	1.14.0-1

Notes

[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
[bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h
https://github.com/rabbitmq/amqp091-go/pull/355
https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e (v1.13.0)