Fluid Attacks Database

Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	stdlib	>=0 <1.25.12	1.25.12
debian 13	golang-1.24	=1.24.12-1 \|\| =1.24.13-1 \|\| =1.24.13-2 \|\| =1.24.4-1 \|\| =1.24.4-2 \|\| =1.24.4-3 \|\| =1.24.4-4 \|\| =1.24.7-1 \|\| =1.24.8-1 \|\| =1.24.9-1	-
debian 14	golang-1.25	=1.25.0-1 \|\| =1.25.0-2 \|\| =1.25.1-1 \|\| =1.25.10-1 \|\| =1.25.10-1~bpo13+1 \|\| =1.25.10-2 \|\| =1.25.10-2~bpo13+1 \|\| =1.25.11-1 \|\| =1.25.11-1~bpo13+1 \|\| =1.25.12-1~bpo13+1 \|\| =1.25.2-1 \|\| =1.25.3-1 \|\| =1.25.6-1 \|\| =1.25.7-1 \|\| =1.25.7-2 \|\| =1.25.8-1 \|\| =1.25.9-1 \|\| >=0 <1.25.12-1	1.25.12-1
debian 14	golang-1.26	=1.26.0-1 \|\| =1.26.1-1 \|\| =1.26.2-1 \|\| =1.26.2-2 \|\| =1.26.2-3 \|\| =1.26.3-1 \|\| =1.26.3-1~bpo13+1 \|\| =1.26.3-2 \|\| =1.26.3-2~bpo13+1 \|\| =1.26.4-1 \|\| =1.26.4-1~bpo13+1 \|\| =1.26.5-1~bpo13+1 \|\| =1.26~rc2-1 \|\| =1.26~rc3-1 \|\| =1.26~rc3-2 \|\| >=0 <1.26.5-1	1.26.5-1
debian 14	golang-1.27	=1.27~rc1-1 \|\| >=0 <1.27~rc2-1	1.27~rc2-1
rpm rhel8	go-toolset	<0:1.26.5-1.module+el8.10.0+24506+6809f2d9	0:1.26.5-1.module+el8.10.0+24506+6809f2d9
rpm rhel10	golang	<0:1.26.5-1.el10_2	0:1.26.5-1.el10_2
rpm rhel9	golang	<0:1.26.5-1.el9_8	0:1.26.5-1.el9_8

Aliases

1. CVE-2026-425052. NVD-2026-425053. OSV-GO-2026-58564. OSV-2026-425055. OSV-DEBIAN-2026-425056. GCVE-2026-425057. SECURITY-TRACKER-CVE-2026-42505

References

1. https://go.dev/cl/7759602. https://go.dev/issue/792823. https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.