Information Disclosure Vulnerability in Go Programming Language
CVE-2025-61730

5.3MEDIUM

Key Information:

Vendor

Go Standard Library

Status
Crypto/tls
Vendor
CVE Published:
28 January 2026

What is CVE-2025-61730?

During the TLS 1.3 handshake process in the Go programming language, there exists a scenario where multiple messages may be sent in records that cross encryption level boundaries, such as the Client Hello and Encrypted Extensions messages. This mishandling can lead to minor information disclosure if an attacker on the same network is able to inject messages during the handshake process. The vulnerability highlights the importance of robust encryption level management in secure communications, emphasizing the necessity for developers to ensure strict adherence to protocols to safeguard data integrity and confidentiality.

Affected Version(s)

crypto/tls 0 < 1.24.12

crypto/tls 1.25.0 < 1.25.6

References

https://go.dev/cl/724120
https://go.dev/issue/76443
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Coia Prant (github.com/rbqvq)
.