CVE-2026-77405Patch

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-326

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-18: 1Patch / Workaround · 2026-09-18: 1Technical Details · 2026-09-18: 109-18
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Cybersecurity News DE@cybsecuritynews
    Patch

    #schwachstellen Kritische Lücken in RabbitMQ amqp091-go: Drei CVEs bis CVSS 9.5 vor Version 1.13.0 #amqp #amqp091go #cve202677405 #cve202677408 #cve202677411 #go #rabbitmq https://cybersecurity-news.de/rabbitmq-amqp091-go-cve-2026-77405-cve-2026-77408-cve-2026-77411

    Post summary

    The tweet announces three critical CVEs in RabbitMQ amqp091-go with CVSS scores up to 9.5 affecting versions before 1.13.0, pointing to version 1.13.0 as the remediation. It provides technical details but does not mention PoCs, exploit tools, or active exploitation.

    0000036
    13 followersView on X

Explore more