Medium severity · published Oct 29, 2025
CVE-2025-58189
ALPN negotiation error contains attacker controlled information in crypto/tls
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
crypto/tls · Go standard library
before 1.24.8; 1.25.0 before 1.25.2 · source: vendor
GO
GO · Golang
before 1.24.8; 1.25.0 before 1.25.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58189
Patch
https://go.dev/cl/707776
Issue Tracking
https://go.dev/issue/75652
Mailing List
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
Vendor Advisory
https://pkg.go.dev/vuln/GO-2025-4008
Mailing List
http://www.openwall.com/lists/oss-security/2025/10/08/1
More from crypto/tls
10.0
CVE-2025-68121
Unexpected session resumption in crypto/tls
7.5
CVE-2026-97031
Reject malformed ECH outer extension references in crypto/tls
7.5
CVE-2026-56862
Limit handshake messages we are willing to accept post-handshake in crypto/tls
7.5
CVE-2026-32283
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
5.3
CVE-2026-42505
Invoking Encrypted Client Hello privacy leak in crypto/tls