CVE-2025-68121

CRITICAL EPSS 50.8%
Published Feb 5, 20264mo ago · Modified Jun 17, 20262w ago
10.0 CVSS 3.1
Critical
Find Similar
Published Feb 5, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

CVSS Details

Base Score
10.0
Exploitability
3.9
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
50.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-295

Affected Products 4

VendorProductVersionRange
golanggo* <1.24.13
golanggo*≥1.25.0  –  <1.25.7
golanggo1.26.0any
golanggo1.26.0any

References 4

  • go.dev https://go.dev/cl/737700
    Patch
  • go.dev https://go.dev/issue/77217
    ExploitIssue Tracking
  • groups.google.com https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
    Mailing ListThird Party Advisory
  • pkg.go.dev https://pkg.go.dev/vuln/GO-2026-4337
    Vendor Advisory

Remediation

  • go.dev https://go.dev/cl/737700
    Patch