GO-2026-4340

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-4340

Import Source

https://vuln.go.dev/ID/GO-2026-4340.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-4340

Aliases

CVE-2025-61730

Published

2026-01-28T19:08:09Z

Modified

2026-01-28T19:41:17.807419Z

Summary

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Details

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-4340"
}

References

Credits

- Coia Prant (github.com/rbqvq)

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.24.12

Introduced

1.25.0

Fixed

1.25.6

Ecosystem specific

{
    "imports": [
        {
            "path": "crypto/tls",
            "symbols": [
                "Conn.Handshake",
                "Conn.HandshakeContext",
                "Conn.Read",
                "Conn.Write",
                "Conn.handleKeyUpdate",
                "Conn.handshakeContext",
                "Conn.quicSetReadSecret",
                "Dial",
                "DialWithDialer",
                "Dialer.Dial",
                "Dialer.DialContext",
                "QUICConn.HandleData",
                "QUICConn.Start",
                "clientHandshakeStateTLS13.establishHandshakeKeys",
                "clientHandshakeStateTLS13.readServerFinished",
                "clientHandshakeStateTLS13.sendClientFinished",
                "serverHandshakeStateTLS13.checkForResumption",
                "serverHandshakeStateTLS13.doHelloRetryRequest",
                "serverHandshakeStateTLS13.readClientFinished",
                "serverHandshakeStateTLS13.sendServerFinished",
                "serverHandshakeStateTLS13.sendServerParameters"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-4340.json"