When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://go.dev/cl/707776 Patch
- https://pkg.go.dev/vuln/GO-2025-4008 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · golangNVD modified 2026-10-08 10:10
Affected (CPE criteria) 1
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
References 5
- https://go.dev/cl/707776 Patch
- https://go.dev/issue/75652 Issue Tracking
- https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI Mailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2025-4008 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/10/08/1 Mailing List, Release Notes, Third Party Advisory