CVE-2025-68121
AI description
CVE-2025-68121 is a vulnerability found within the `crypto/tls` package of the Go programming language, addressed in Go versions 1.25.6 and 1.24.12. This vulnerability encompasses two primary issues. Firstly, the `Config.Clone` function was found to leak automatically generated session ticket keys, which could potentially enable unauthorized session resumptions across different configurations. Secondly, the vulnerability involved an oversight in how TLS session resumptions were handled on the server side. Specifically, when determining if a session could be resumed, only the expiration of the leaf certificate was checked, neglecting the expiration status of intermediate or root certificates within the full certificate chain. This allowed sessions to be resumed even if a critical certificate in the chain had expired.
- Description
- -
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
30
Go 1.25.6 and 1.24.12 fix 6 CVEs https://t.co/XjElQGk7ZQ CVE-2025-61728 archive/zip: DoS CVE-2025-61726 net/http: Memory exhaustion CVE-2025-68121 crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for chain expiration
@oss_security
16 Jan 2026
917 Impressions
2 Retweets
11 Likes
2 Bookmarks
1 Reply
0 Quotes
🥳 Go 1.26 Release Candidate 2 is released! 🔐 Security: Includes security fixes for archive/zip (CVE-2025-61728), net/http (CVE-2025-61726), crypto/tls (CVE-2025-68121, CVE-2025-61730), cmd/go (CVE-2025-61731, CVE-2025-68119). 🏃♀️ Run it in dev! Run it in prod! F
@golang
15 Jan 2026
22045 Impressions
52 Retweets
423 Likes
30 Bookmarks
4 Replies
2 Quotes
🎊 Go 1.25.6 and 1.24.12 are released! 🔐 Security: Includes security fixes for archive/zip (CVE-2025-61728), net/http (CVE-2025-61726), crypto/tls (CVE-2025-68121, CVE-2025-61730), cmd/go (CVE-2025-61731, CVE-2025-68119). 📣 Announcement: https://t.co/seVA1REoeH 📦 Do
@golang
15 Jan 2026
14651 Impressions
53 Retweets
279 Likes
26 Bookmarks
4 Replies
3 Quotes
A Go release scheduled for Thursday, Jan 15th covering CVE-2025-61728 CVE-2025-61726 CVE-2025-68121 CVE-2025-61731 CVE-2025-68119, all currently embargoed. Reports of an SSH 0-day, in context of Go's crypto/ssh module.
@_mattata
13 Jan 2026
327 Impressions
0 Retweets
5 Likes
0 Bookmarks
0 Replies
0 Quotes