CVE-2025-58189

ALPN negotiation error contains attacker controlled information in crypto/tls

State: Published
Severity: 5.3 Medium
Published: Oct 29, 2025
Updated: Nov 4, 2025
Reserved: Aug 27, 2025

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
crypto/tlsGo standard library	before 1.24.8Affected 1.25.0 to before 1.25.2Affected

References

https://go.dev/cl/707776
https://go.dev/issue/75652
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
https://pkg.go.dev/vuln/GO-2025-4008
http://www.openwall.com/lists/oss-security/2025/10/08/1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.