Skip to content
Heist/ feed
Back to feed
Medium

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Type: advisorySources: OSV

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-61730
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 03:12 UTC · Revision 1

Source evidence

Handshake messages may be processed at the incorrect encryption level in crypto/tls

core-osv · Original source

Published 28 Jan 2026, 19:30 UTC

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

osv:CVE-2025-61730
Complete source record
{
  "id": "b914044ba0ec62ef0adc7cdcf0bb5fdb40412a3805707eb854a95a7f2033ce17",
  "url": "https://osv.dev/vulnerability/CVE-2025-61730",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Handshake messages may be processed at the incorrect encryption level in crypto/tls",
    "summary": "During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.",
    "evidence": "osv:CVE-2025-61730",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-61730",
      "aliases": [
        "BIT-golang-2025-61730",
        "CVE-2025-61730",
        "GO-2026-4340"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/golang/go",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "63a1b82d1e68ddd87652467303901593efe0ff11"
                },
                {
                  "introduced": "6e676ab2b809d46623acb5988248d95d1eb7939c"
                },
                {
                  "fixed": "69801b25b9624c3a678ef87d30771861e7bba51f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.24.12"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.25.0"
                      },
                      {
                        "fixed": "1.25.6"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "go1.24.11",
            "go1.25.5",
            "go1.24.10",
            "go1.25.4",
            "go1.24.9",
            "go1.25.3",
            "go1.24.8",
            "go1.25.2",
            "go1.24.7",
            "go1.25.1",
            "go1.24.6",
            "go1.25.0",
            "go1.24.5",
            "go1.24.4",
            "go1.24.3",
            "go1.24.2",
            "go1.24.1",
            "go1.24.0",
            "go1.24rc3",
            "go1.24rc2",
            "go1.24rc1",
            "go1.19beta1",
            "go1.18beta2",
            "go1.18beta1",
            "go1.17beta1",
            "go1.16beta1",
            "go1.15beta1",
            "go1.14beta1",
            "go1.13beta1",
            "go1.12beta2",
            "go1.12beta1",
            "go1.11beta3",
            "go1.11beta2",
            "go1.11beta1",
            "go1.10rc2",
            "go1.10rc1",
            "go1.10beta2",
            "go1.10beta1",
            "go1.9beta2",
            "go1.9beta1",
            "go1.8beta2",
            "go1.8beta1",
            "go1.7rc4",
            "go1.7rc3",
            "go1.7rc2",
            "go1.7rc1",
            "go1.7beta2",
            "go1.7beta1",
            "go1.6beta2",
            "go1.6beta1",
            "go1.5beta3",
            "go1.5beta2",
            "go1.5beta1",
            "go1.4beta1",
            "go1.3beta2",
            "go1.3beta1",
            "weekly.2012-03-27",
            "weekly",
            "weekly.2012-03-22",
            "weekly.2012-03-13",
            "weekly.2012-03-04",
            "weekly.2012-02-22",
            "weekly.2012-02-14",
            "weekly.2012-02-07",
            "weekly.2012-01-27",
            "weekly.2012-01-20",
            "weekly.2012-01-15",
            "weekly.2011-12-22",
            "weekly.2011-12-14",
            "weekly.2011-12-06",
            "weekly.2011-12-02",
            "weekly.2011-12-01",
            "weekly.2011-11-18",
            "weekly.2011-11-09",
            "weekly.2011-11-08",
            "weekly.2011-11-02",
            "weekly.2011-11-01",
            "weekly.2011-10-26",
            "weekly.2011-10-25",
            "weekly.2011-10-18",
            "weekly.2011-10-06",
            "weekly.2011-09-21",
            "weekly.2011-09-16",
            "weekly.2011-08-17",
            "weekly.2011-09-07",
            "weekly.2011-09-01",
            "weekly.2011-08-10",
            "weekly.2011-07-07",
            "weekly.2011-07-29",
            "weekly.2011-07-19",
            "weekly.2011-06-09",
            "weekly.2011-06-23",
            "weekly.2011-06-16",
            "weekly.2011-06-02",
            "weekly.2011-05-22",
            "weekly.2011-04-27",
            "weekly.2011-04-13",
            "weekly.2011-04-04",
            "weekly.2011-03-28",
            "weekly.2011-03-15",
            "weekly.2011-03-07.1",
            "release.r56",
            "weekly.2011-03-07",
            "weekly.2011-02-24",
            "weekly.2011-02-15",
            "weekly.2011-02-01.1",
            "weekly.2011-02-01",
            "weekly.2011-01-20",
            "weekly.2011-01-19",
            "weekly.2011-01-12",
            "weekly.2011-01-06",
            "weekly.2010-12-22",
            "weekly.2010-12-15.1",
            "weekly.2010-12-15",
            "weekly.2010-12-08",
            "weekly.2010-12-02",
            "weekly.2010-11-23",
            "weekly.2010-11-10",
            "weekly.2010-11-02",
            "weekly.2010-10-27",
            "weekly.2010-10-20",
            "weekly.2010-10-13.1",
            "weekly.2010-10-13",
            "weekly.2010-09-29",
            "weekly.2010-09-22",
            "weekly.2010-09-15",
            "weekly.2010-09-06",
            "weekly.2010-08-25",
            "weekly.2010-08-11",
            "weekly.2010-08-04",
            "weekly.2010-07-29",
            "weekly.2010-07-14",
            "weekly.2010-07-01",
            "weekly.2010-06-21",
            "weekly.2010-06-09",
            "weekly.2010-05-27",
            "weekly.2010-05-04",
            "weekly.2010-04-27",
            "weekly.2010-04-13",
            "weekly.2010-03-30",
            "weekly.2010-03-22",
            "weekly.2010-03-15",
            "weekly.2010-03-04",
            "weekly.2010-02-23",
            "weekly.2010-02-17",
            "weekly.2010-02-04",
            "weekly.2010-01-27",
            "weekly.2010-01-13",
            "weekly.2010-01-05",
            "weekly.2009-12-22",
            "weekly.2009-12-09",
            "weekly.2009-12-07",
            "weekly.2009-11-17",
            "weekly.2009-11-12",
            "weekly.2009-11-10.1",
            "weekly.2009-11-10",
            "weekly.2009-11-06"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61730.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.455477300Z",
      "provider": "osv",
      "references": [
        "https://go.dev/cl/724120",
        "https://go.dev/issue/76443",
        "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
        "https://pkg.go.dev",
        "https://pkg.go.dev/vuln/GO-2026-4340",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61730.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-61730"
      ],
      "provider_metadata": {
        "cna_assigner": "Go",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "1.24.12"
                  },
                  {
                    "introduced": "1.25.0"
                  },
                  {
                    "fixed": "1.25.6"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61730.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-61730",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492134,
  "published_at": "2026-01-28T19:30:30.986+00:00"
}