CVE-2026-42505CWE-201

CVE-2026-42505

Medium · published July 8, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-07-08T21:17Z
Affected products (3)
ProductVersionsFixed in
golang/go≥ 1.23.0, < 1.25.121.25.12
golang/go≥ 1.26.0, < 1.26.51.26.5
golang/goall versions—
References (4)
https://go.dev/cl/775960 · [email protected]https://go.dev/issue/79282 · [email protected]https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc · [email protected]https://pkg.go.dev/vuln/GO-2026-5856 · [email protected]
EPSS history
Timeline
  • 08 JUL 15:46Z
    Invoking Encrypted Client Hello privacy leak in crypto/tls
    cvelistv5