VulnerabilityAnalyzed
CVE-2025-61730
This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
MEDIUM 5.3EPSS 0.29%
Does this matter?
Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.
Description
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.29% probability · 21th percentile
- CISA KEV
- Not listed
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/724120Patch
- https://go.dev/issue/76443Patch
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUcRelease Notes
- https://pkg.go.dev/vuln/GO-2026-4340Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.