GO-2025-4008

vendorUSosv

ALPN negotiation error contains attacker controlled information in crypto/tls

view advisory published 2025-10-29Licence: per source

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-58189US	—	0.47% (40th)	—	2025-10-29
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/707776FIX
https://go.dev/issue/75652REPORT
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bIWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan