CVE-2026-42505

MEDIUM

Invoking Encrypted Client Hello privacy leak in crypto/tls

Title source: cna

Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

References (4)

Core 4

Core References

https://go.dev/cl/775960

https://go.dev/issue/79282

https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc

https://pkg.go.dev/vuln/GO-2026-5856

Scores

CVSS v3 5.3

EPSS 0.0042

EPSS Percentile 33.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-201

Status published

Products (5)

Go standard library/crypto/tls < 1.25.12

Go standard library/crypto/tls 1.26.0-0 - 1.26.5

Go standard library/crypto/tls 1.27.0-0 - 1.27.0-rc.2

golang/go 1.27 rc1

golang/go < 1.25.12

Published Jul 08, 2026

Tracked Since Jul 08, 2026