5.3
Moyenne
CVE-2025-58189 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols…
Description
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| crypto/tls 1.25 | 1.25.0 → < 1.25.2 | 1.25.2 |
| crypto/tls 1.24 | premières → < 1.24.8 | 1.24.8 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de crypto/tls
Les 13 CVE de crypto/tls →
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted…
7.5
Élevée
CVE-2026-56862
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has…
7.5
Élevée
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of…
5.3
Moyenne
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…
7.5
Élevée