Skip to main content
cve.nowby Sazabi
← Go
GoPackage

crypto/tls

12 known vulnerabilities (1 critical, 2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 1 critical, 2 high, 3 medium, 1 low
Registry
pkg.go.dev

Advisories 12

  • Limit handshake messages we are willing to accept post-handshake in crypto/tls

    Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

  • CVE-2026-42505Medium 5.3

    Invoking Encrypted Client Hello privacy leak in crypto/tls

    Affected: fixed in 1.25.12; from 1.26.0-0, fixed in 1.26.5; from 1.27.0-0, fixed in 1.27.0-rc.2.

  • Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

  • CVE-2025-68121Critical 9.1

    Unexpected session resumption in crypto/tls

    Affected: fixed in 1.24.13; from 1.25.0-0, fixed in 1.25.7; from 1.26.0-rc.1, fixed in 1.26.0-rc.3.

  • CVE-2025-61730Medium 5.3

    Handshake messages may be processed at the incorrect encryption level in crypto/tls

    Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.

  • CVE-2025-58189Medium 5.3

    ALPN negotiation error contains attacker controlled information in crypto/tls

    Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

  • Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

    Affected: fixed in 1.20.0.

  • Memory exhaustion in QUIC connection handling in crypto/tls

    Affected: from 1.21.0-0, fixed in 1.21.1.

  • Panic when processing post-handshake message on QUIC connections in crypto/tls

    Affected: from 1.21.0-0, fixed in 1.21.1.

  • Large RSA keys can cause high CPU usage in crypto/tls

    Affected: fixed in 1.19.12; from 1.20.0-0, fixed in 1.20.7; from 1.21.0-0, fixed in 1.21.0-rc.4.

  • Panic on large handshake records in crypto/tls

    Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

  • Session tickets lack random ticket_age_add in crypto/tls

    Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.