Skip to content
Heist/ feed
UnratedFix available

Unexpected session resumption in crypto/tls

Type: advisorySource: OSV1 source record

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Announced Source revision 1
Original source ↗

GO-2026-4337

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GO-2026-4337

stdlib

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.24.13

Source reference: /affected/0/ranges

1.25.7

Source reference: /affected/0/ranges

1.26.0-rc.3

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.24.13"
          },
          {
            "introduced": "1.25.0-0"
          },
          {
            "fixed": "1.25.7"
          },
          {
            "introduced": "1.26.0-rc.1"
          },
          {
            "fixed": "1.26.0-rc.3"
          }
        ]
      }
    ],
    "package": {
      "name": "stdlib",
      "purl": "pkg:golang/stdlib",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://vuln.go.dev/ID/GO-2026-4337.json"
    },
    "ecosystem_specific": {
      "imports": [
        {
          "path": "crypto/tls",
          "symbols": [
            "Conn.Handshake",
            "Conn.HandshakeContext",
            "Conn.Read",
            "Conn.Write",
            "Conn.handshakeContext",
            "Dial",
            "DialWithDialer",
            "Dialer.Dial",
            "Dialer.DialContext",
            "QUICConn.Start"
          ]
        }
      ]
    }
  }
]
Related CVEs
CVE-2025-68121

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#27680 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement