CWE-757: Default TLS minimum version set to TLS 1.0 (deprecated, vulnerable to downgrade)

[LeoWSY-hashblue]

Summary

The default TLS configuration in nsqd sets the minimum protocol version to TLS 1.0, which has been formally deprecated since RFC 8996 (March 2021).

Details

nsqd/options.go:182:

TLSMinVersion: tls.VersionTLS10,

Users who don't explicitly set --tls-min-version=tlsv1.2 get TLS 1.0.

Impact

• TLS 1.0 has known vulnerabilities: BEAST (CVE-2011-3389), POODLE (CVE-2014-3566)
• Violates PCI DSS 3.1+ and FedRAMP compliance requirements

Remediation

Change to TLSMinVersion: tls.VersionTLS12, as default.