{"id":"EUVD-2026-80818","revision":null,"records":[{"revision":"7b7c2783f9ec498292613b5611453c8d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-77405","aliases":[],"title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","state":0,"publishedAt":"2026-09-16T14:42:08.67+00:00","modifiedAt":"2026-09-18T17:59:20.584+00:00","affected":[{"ecosystem":"Vendor product","name":"amqp091-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rabbitmq\",\n                    \"product\": \"amqp091-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.13.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","score":9.4,"severity":"CRITICAL"}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h","https://github.com/rabbitmq/amqp091-go/pull/355","https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77405","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77405","identifiers":["CVE-2026-77405"]},"retained":false,"historicalAffected":[]},{"revision":"b30a82dc7cc54fec87106d41414937bf","observedAt":"2026-11-11T16:08:41.483+00:00","statement":{"source":"euvd","id":"EUVD-2026-80818","aliases":["CVE-2026-77405","GHSA-33mj-cw25-m34h"],"title":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can ther…","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","score":9.4,"severity":null}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h","https://github.com/rabbitmq/amqp091-go/pull/355","https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80818","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 16, 2026, 2:42:08 PM","dateUpdated":"Sep 18, 2026, 5:59:20 PM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-77405","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","vulnerabilityIds":["CVE-2026-77405"]},{"id":"RHSA-2026:92307","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update","vulnerabilityIds":["CVE-2026-14199","CVE-2026-15815","CVE-2026-33818","CVE-2026-37236","CVE-2026-39834","CVE-2026-56853","CVE-2026-56854","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-77354","CVE-2026-77405","CVE-2026-77411","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-88031","CVE-2026-93748","CVE-2026-106445","CVE-2026-106446"]},{"id":"RHSA-2026:95517","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.4 security update","vulnerabilityIds":["CVE-2026-14199","CVE-2026-15815","CVE-2026-17183","CVE-2026-39834","CVE-2026-42127","CVE-2026-63209","CVE-2026-73501","CVE-2026-73502","CVE-2026-76905","CVE-2026-77354","CVE-2026-77405","CVE-2026-77411","CVE-2026-84445","CVE-2026-88031","CVE-2026-92542","CVE-2026-92543"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-80818","identifiers":["EUVD-2026-80818","CVE-2026-77405","GHSA-33mj-cw25-m34h"]},"retained":false,"historicalAffected":[]},{"revision":"ee53e514b9da470ebf49f1cceb243879","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-77405","aliases":[],"title":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can ther…","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","state":0,"publishedAt":"2026-09-16T15:17:47.98+00:00","modifiedAt":"2026-09-24T21:16:28.12+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.4,"severity":"CRITICAL"}],"references":["https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e","https://github.com/rabbitmq/amqp091-go/pull/355","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0","https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77405","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-326"],"productCriteria":[],"sourceDates":{"published":"2026-09-16T15:17:47.980","lastModified":"2026-09-24T21:16:28.120"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-77405","identifiers":["CVE-2026-77405"]},"retained":false,"historicalAffected":[]},{"revision":"d2ca10557bb4419c905ffa913670cbe7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-33mj-cw25-m34h","aliases":["CVE-2026-77405","GO-2026-6492"],"title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"## Summary\nA structural security weakness exists in the AMQP client's TLS configuration generator (`tlsConfigFromURI`). When constructing a `*tls.Config` object from an `amqps://` connection URI, the library initializes the structure without explicitly defining the `MinVersion` field. \n\nWhile modern versions of the Go compiler toolchain (Go 1.18+) default the implicit minimum version to TLS 1.2, this security posture relies entirely on an implicit toolchain dependency. If the library is compiled using legacy Go toolchains (Go < 1.18), or if a future toolchain introduces fallback behavior, the client could silently negotiate obsolete and insecure TLS 1.0 or TLS 1.1 protocols during connection handshakes with a compromised or malicious AMQP broker.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe vulnerability lies in the lack of an explicit safety floor when assigning configurations inside the URI component:\n\n```go\n// Example within uri.go's tlsConfigFromURI\ncfg := &tls.Config{\n    ServerName: host,\n    // MinVersion is left completely unassigned (defaults to 0, or toolchain default)\n}\n```\n\nIn the Go standard library (`crypto/tls`), leaving `MinVersion: 0` instructs the runtime to choose the toolchain's default minimum. Prior to Go 1.18, this default allowed negotiation down to TLS 1.0. Relying on implicit compiler configurations violates secure coding practices by decoupling the library's security posture from its source code, leaving applications vulnerable based solely on how they are built.\n\n### Impact\nIf a client application is built with a legacy compiler environment or a custom Go runtime, an attacker capable of executing a Man-in-the-Middle (MitM) attack can force the connection to downgrade to TLS 1.0 or 1.1. This exposes the AMQP protocol data stream to well-known cryptographic vulnerabilities (such as BEAST, POODLE, or SWEET32), allowing the attacker to decrypt or alter message payloads, connection parameters, and authentication credentials.\n\n---\n\n## Attack Vector\nAn attacker performing a network-level downgrade attack can intercept a client connection built under a legacy toolchain:\n\n1. **Interception:** A client application compiled on a legacy pipeline attempts to establish an encrypted connection to an AMQP broker.\n2. **Protocol Downgrade:** The attacker intercepts the TLS Client Hello handshake and forces a downgrade negotiation to TLS 1.0.\n3. **Cryptographic Exploitation:** Because `MinVersion` was never explicitly locked to `tls.VersionTLS12` by the library, the client accepts the weak cipher suites, allowing the attacker to monitor or manipulate the underlying AMQP session data.","state":0,"publishedAt":"2026-09-17T17:04:01+00:00","modifiedAt":"2026-10-01T20:56:07.6895067+00:00","affected":[{"ecosystem":"Go","name":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h","https://nvd.nist.gov/vuln/detail/CVE-2026-77405","https://github.com/rabbitmq/amqp091-go/pull/355","https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e","https://github.com/rabbitmq/amqp091-go","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://github.com/advisories/GHSA-33mj-cw25-m34h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-33mj-cw25-m34h","identifiers":["GHSA-33mj-cw25-m34h","CVE-2026-77405","GO-2026-6492"]},"retained":false,"historicalAffected":[]},{"revision":"ba76d24248974084801831897f01b19d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6492","aliases":["CVE-2026-77405","GHSA-33mj-cw25-m34h"],"title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go","description":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go","state":0,"publishedAt":"2026-10-01T20:23:56+00:00","modifiedAt":"2026-10-01T20:45:11.3038788+00:00","affected":[{"ecosystem":"Go","name":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h","https://nvd.nist.gov/vuln/detail/CVE-2026-77405","https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e","https://github.com/rabbitmq/amqp091-go/pull/355","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6492","license":"OSV · upstream source license applies","key":"osv:GO-2026-6492","identifiers":["GO-2026-6492","CVE-2026-77405","GHSA-33mj-cw25-m34h"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7696899+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7696907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-0cd050aa4e3407be88a99da87c4684cdd6e2bb2192e7b5d8516c5221fe2996c0","complete":true,"records":424321,"lastAttemptAt":"2026-11-11T21:56:53.6118096+00:00","lastSuccessAt":"2026-11-11T21:56:53.4062549+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.6118096+00:00","snapshotPublishedAt":"2026-11-11T21:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0211f24f7dd2479496f11922c7aad014","complete":false,"records":13760,"lastAttemptAt":"2026-11-11T22:09:10.3527395+00:00","lastSuccessAt":"2026-11-11T22:09:09.323+00:00","error":"346 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T22:09:09.323+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13257,"expectedIdentifiers":13813,"failedIdentifiers":346},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7704457+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7704461+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e103bc43c8e54398a828cba9bdd81bf5","complete":true,"records":13754,"lastAttemptAt":"2026-11-11T21:59:28.9840194+00:00","lastSuccessAt":"2026-11-11T21:59:28.981+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:59:28.981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T21:58:49.3669281+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.3669281+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T21:56:53.7926299+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.7926299+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T21:58:49.4873797+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.4873797+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-11T21:58:49.2338613+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.2338613+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}