ALPN Negotiation Flaw in Go Programming Language

CVE-2025-58189

What is CVE-2025-58189?

A security issue in the Go programming language arises during the ALPN negotiation process. When the conn.Handshake operation fails, it improperly exposes attacker-controlled information, specifically the ALPN protocols presented by the client. This flaw can be exploited to expose sensitive data, potentially undermining the application's security. Developers using affected versions of Go should apply the necessary patches to mitigate this risk.

References