5.3
Medium
CVE-2025-58189 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols…
Description
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto/tls 1.25 | 1.25.0 → < 1.25.2 | 1.25.2 |
| crypto/tls 1.24 | earliest → < 1.24.8 | 1.24.8 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of crypto/tls
The 13 CVEs of crypto/tls →
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted…
7.5
High
CVE-2026-56862
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has…
7.5
High
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of…
5.3
Medium
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…
7.5
High