CVE-2025-61730

Published Jan 28, 2026

Last updated a month ago

CVSS medium 5.3

Golang

SSL

Overview

Description: During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
Source: security@golang.org
NVD status: Analyzed
Products: go

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "21FD9368-8AB3-404B-8599-BBF64EFE3C7B",
            "versionEndExcluding": "1.24.12",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A547E844-78D2-4B17-B7A9-73E7B503D2CE",
            "versionEndExcluding": "1.25.6",
            "versionStartIncluding": "1.25.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References