Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-58189

ALPN negotiation error contains attacker controlled information in crypto/tls

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library crypto/tls

Default version status: unaffected

  • 0 to < 1.24.8affected
  • 1.25.0 to < 1.25.2affected

References