{
  "cveId": "CVE-2026-77405",
  "url": "https://patchblox.com/security/cve/CVE-2026-77405",
  "summary": "CVE-2026-77405 is fixed in golang-github-rabbitmq-amqp091-go on 1 platform by DEBIAN-CVE-2026-77405 (version 1.14.0-1), released September 18, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser",
  "description": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.",
  "published": "2026-09-16T15:17:47Z",
  "severity": "Critical",
  "cwe": "Inadequate Encryption Strength",
  "epss": 0.00282,
  "epssPercentile": 0.20817,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77405",
  "fixes": [
    {
      "platform": "linux",
      "product": "golang-github-rabbitmq-amqp091-go",
      "release": "Debian 14",
      "fixedVersion": "1.14.0-1",
      "fix": "DEBIAN-CVE-2026-77405",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-77405",
      "released": "2026-09-18T18:19:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}