CVE-2025-58189CWE-532

CVE-2025-58189

Medium · published October 30, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.5th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-10-30T03:16Z
Affected products (2)
ProductVersionsFixed in
golang/go< 1.24.81.24.8
golang/go≥ 1.25.0, < 1.25.21.25.2
References (5)
https://go.dev/cl/707776 · [email protected]https://go.dev/issue/75652 · [email protected]https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI · [email protected]https://pkg.go.dev/vuln/GO-2025-4008 · [email protected]http://www.openwall.com/lists/oss-security/2025/10/08/1 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 29 OCT 22:10Z
    ALPN negotiation error contains attacker controlled information in crypto/tls
    cvelistv5