CVE-2026-42505: falha de média gravidade em Go standard library crypto/tls
Invoking Encrypted Client Hello privacy leak in crypto/tls
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Go standard library · crypto/tlsCVEs relacionadas — Go standard library crypto/tls
No mesmo produto, das mais perigosas para as menos.
CVE-2023-29409—Large RSA keys can cause high CPU usage in crypto/tlsEPSS 1.6%CVE-2023-39322—Memory exhaustion in QUIC connection handling in crypto/tlsEPSS 1.3%CVE-2023-39321—Panic when processing post-handshake message on QUIC connections in crypto/tlsEPSS 1.3%CVE-2023-45287—Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelEPSS 1.3%CVE-2022-30629LOWSession tickets lack random ticket_age_add in crypto/tlsEPSS 1.2%CVE-2022-41724—Panic on large handshake records in crypto/tlsEPSS 1.1%