Vulnerability in Let's Encrypt Client and ACME Library for Go
CVE-2025-54799

2.3LOW

Key Information:

Vendor

Go-acme

Status
Lego
Vendor
CVE Published:
7 August 2025

What is CVE-2025-54799?

The ACME library (Lego) written in Go is susceptible to insecure communication issues due to its failure to enforce HTTPS connections when interacting with Certificate Authorities (CAs) as an ACME client. Specifically, versions 4.25.1 and earlier do not mandate HTTPS for the original discovery URLs set by users, nor for subsequent addresses provided by CAs. As a result, CA interactions, which should be securely handled over HTTPS, may be conducted over HTTP if users specify HTTP URLs or if CAs misconfigure endpoints. This vulnerability may lead to exposure of sensitive details such as account and request identifiers to potential network attackers, jeopardizing user privacy and security. This issue was effectively addressed in version 4.25.2 of the library.

Affected Version(s)

lego < 4.25.2

References

https://github.com/go-acme/lego/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/go-acme/lego/commit/238454b5f74f3cfcbb...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

.
CVE-2025-54799 : Vulnerability in Let's Encrypt Client and ACME Library for Go