CVE-2026-42505

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42505
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42505.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42505
Aliases
Downstream
AZL (2)
BELL (1)
CGA (9343)
CLEANSTART (182)
DEBIAN (1)
MGASA (1)
MINI (1779)
openSUSE (10)
RHSA (5)
SUSE (10)
UBUNTU (1)
Related
openSUSE (10)
SUSE (10)
Published
2026-07-08T15:46:33Z
Modified
2026-09-18T03:46:32Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Invoking Encrypted Client Hello privacy leak in crypto/tls
Details

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Database specific 
{
    "cna_assigner":  "Go",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42505.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "1.25.12"
                },
                {
                    "introduced":  "1.26.0-0"
                },
                {
                    "fixed":  "1.26.5"
                },
                {
                    "introduced":  "1.27.0-0"
                },
                {
                    "fixed":  "1.27.0-rc.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/golang/go

Affected ranges

Type
GIT
Repo
https://github.com/golang/go
Events
Introduced
6885bad7dd86880be6929c02085e5c7a67ff2887
Fixed
d80d9a98f7e3a8f9b3a82d2c6079f84eb1101d46
Introduced
d90b98e65320778f3b1f99a6951ab20f04d218b3
Fixed
c19862e5f8415b4f24b189d065ed739517c548ba
Introduced
eefb454307250192f45fa3718685e4c0a90e281d
Last Affected
eefb454307250192f45fa3718685e4c0a90e281d
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:golang:go:1.27:rc1:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "1.23.0"
        },
        {
            "fixed":  "1.25.12"
        },
        {
            "introduced":  "1.26.0"
        },
        {
            "fixed":  "1.26.5"
        },
        {
            "introduced":  "1.27-rc1"
        },
        {
            "last_affected":  "1.27-rc1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

1.*
1.27-rc1
go1.*
go1.26.0
go1.26.1
go1.26.2
go1.26.3
go1.26.4
go1.27rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42505.json"