CVE-2026-42505

Опубликовано: 08 июл. 2026

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Ссылки

https://go.dev/cl/775960
Patch
https://go.dev/issue/79282
Issue Tracking
Patch
https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
Mailing List
Release Notes
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-5856
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Версия от 1.23.0 (включая) до 1.25.12 (исключая)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Версия от 1.26.0 (включая) до 1.26.5 (исключая)

cpe:2.3:a:golang:go:1.27:rc1:*:*:*:*:*:*

EPSS

Процентиль: 32%

0.00382

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-201

Связанные уязвимости

CVE-2026-42505

CVSS3: 5.3

ubuntu

4 месяца назад

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

CVE-2026-42505

CVSS3: 5.3

redhat

4 месяца назад

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

CVE-2026-42505

CVSS3: 5.3

msrc

4 месяца назад

Invoking Encrypted Client Hello privacy leak in crypto/tls

CVE-2026-42505

CVSS3: 5.3

debian

4 месяца назад

Handshakes which used Encrypted Client Hello could be de-anonymized by ...

ROS-20260813-80-0053

CVSS3: 5.3

redos

3 месяца назад

Уязвимость golang

EPSS

Процентиль: 32%

0.00382

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-201