BIT-golang-2025-61730

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2025-61730.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-golang-2025-61730

Aliases

Published

2026-01-31T08:43:36Z

Modified

2026-09-08T08:47:35Z

Summary

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Details

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / golang

Package

Name: golang
Purl: pkg:bitnami/golang

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.24.12

Introduced

1.25.0

Fixed

1.25.6

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2025-61730.json"