CVE-2025-58189: go standard library crypto/tls

CVSS: 5.3v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2025-58189DEBIAN-CVE-2025-58189CGA-224g-87qp-8fv6+3971 more

Published 29-10-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-58189 is a medium (CVSS 5.3) vulnerability in go standard library crypto/tls. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.4% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.47%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 91

MGASA-2025-0256 OPENSUSE-SU-2025:15608-1 OPENSUSE-SU-2025:15609-1 OPENSUSE-SU-2025:15695-1 OPENSUSE-SU-2025:15723-1 OPENSUSE-SU-2025:20157-1+86 more

Timeline

29-10-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

CVSS metrics

6 scores · 6 sources · 1 version

v3.15.3

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

+0.03 pp

From 0.44% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.

Affected systems

Chainguard200 products

age< 1.2.1-r8
age-fips< 1.2.1-r8
amass< 5.0.1-r1
amazon-k8s-cni-fips< 1.20.4-r2
amazon-k8s-cni-init-fips< 1.20.4-r2

amazon-k8s-cni-init-fips-compat< 1.20.4-r2
ansible-operator< 1.41.0-r1
ansible-operator-compat< 1.41.0-r1
apisix-ingress-controller< 1.8.4-r4
apisix-ingress-controller-compat< 1.8.4-r4
apisix-ingress-controller-iamguarded-compat< 1.8.4-r4
apm-server-7.17< 7.17.29-r4
apm-server-7.17-compat< 7.17.29-r4
apm-server-8.17< 8.17.10-r2
apm-server-8.17-compat< 8.17.10-r2
apm-server-8.18< 8.18.8-r1
apm-server-8.18-compat< 8.18.8-r1
apm-server-fips-7.17< 7.17.29-r4
apm-server-fips-7.17-compat< 7.17.29-r4
apm-server-fips-8.17< 8.17.10-r1
apm-server-fips-8.17-compat< 8.17.10-r1
apm-server-fips-8.18< 8.18.8-r1
apm-server-fips-8.18-compat< 8.18.8-r1
apm-server-fips-9.0< 9.0.8-r1
apm-server-fips-9.0-compat< 9.0.8-r1
argo-cd-2.13-compat< 2.13.9-r2
argo-rollouts< 1.8.3-r4
argo-rollouts-fips< 1.8.3-r5
atlantis< 0.36.0-r2
auditbeat-fips-8.17< 8.17.10-r2
auditbeat-fips-8.18< 8.18.8-r2
auditbeat-fips-9.0< 9.0.8-r2
authservice-fips< 1.1.1-r1
authservice-fips-compat< 1.1.1-r1
aws-iam-authenticator< 0.7.8-r1
aws-iam-authenticator-fips< 0.7.8-r1
aws-node-termination-handler< 1.25.2-r2
aws-node-termination-handler-compat< 1.25.2-r2
aws-node-termination-handler-fips< 1.25.2-r2
aws-node-termination-handler-fips-compat< 1.25.2-r2
aws-privateca-issuer-compat-fips< 1.7.0-r3
aws-privateca-issuer-fips< 1.7.0-r3
aws-s3-controller< 1.1.1-r1
aws-signer-notation-plugin< 1.0.2292-r3
aws-signer-notation-plugin-fips< 1.0.2292-r3
aws-sigv4-proxy< 1.10-r3
aws-sigv4-proxy-compat< 1.10-r3
aws-sigv4-proxy-fips< 1.10-r3
aws-sigv4-proxy-fips-compat< 1.10-r3
azure-aad-pod-identity-mic< 1.8.17-r28
azure-aad-pod-identity-nmi< 1.8.17-r28
azure-container-networking< 1.7.4-r1
azure-ipam< 0.4.0-r4
azure-ipam-dropgz< 0.4.0-r4
azure-vnet-cni< 1.7.4-r1
azure-workload-identity-webhook< 1.5.1-r3
azure-workload-identity-webhook-compat< 1.5.1-r3
azuredisk-csi-fips-1.33< 1.33.5-r1
azurefile-csi-1.30< 1.30.10-r5
azurefile-csi-1.30-compat< 1.30.10-r5
azurefile-csi-1.31< 1.31.8-r1
azurefile-csi-1.31-compat< 1.31.8-r1
azurefile-csi-1.32< 1.32.7-r1
azurefile-csi-1.32-compat< 1.32.7-r1
azurefile-csi-1.33< 1.33.5-r1
azurefile-csi-1.33-compat< 1.33.5-r1
azurefile-csi-fips-1.29< 1.29.12-r5
azurefile-csi-fips-1.29-compat< 1.29.12-r5
azurefile-csi-fips-1.30< 1.30.10-r5
azurefile-csi-fips-1.30-compat< 1.30.10-r5
azurefile-csi-fips-1.31< 1.31.8-r1
azurefile-csi-fips-1.31-compat< 1.31.8-r1
azurefile-csi-fips-1.32< 1.32.7-r1
azurefile-csi-fips-1.32-compat< 1.32.7-r1
bazelisk< 1.27.0-r1
bazelisk-default< 1.27.0-r1
beats-fips-8.17< 8.17.10-r2
beats-fips-8.18< 8.18.8-r2
beats-fips-9.0< 9.0.8-r2
blob-csi-1.23< 1.23.11-r56
blob-csi-1.23-compat< 1.23.11-r56
blob-csi-1.24< 1.24.11-r5
blob-csi-1.24-compat< 1.24.11-r5
blob-csi-1.25< 1.25.10-r1
blob-csi-1.25-compat< 1.25.10-r1
blob-csi-fips-1.23< 1.23.11-r57
blob-csi-fips-1.23-compat< 1.23.11-r57
blob-csi-fips-1.24< 1.24.11-r5
blob-csi-fips-1.24-compat< 1.24.11-r5
blob-csi-fips-1.25< 1.25.10-r1
blob-csi-fips-1.25-compat< 1.25.10-r1
blob-csi-fips-1.26< 1.26.7-r3
blob-csi-fips-1.26-compat< 1.26.7-r3
blobfuse2-fips< 2.4.2-r6
blobfuse2-fips-health-monitor< 2.4.2-r6
blobfuse2-fips-syslog< 2.4.2-r6
bom< 0.7.1-r1
boring-registry< 0.16.6-r2
boring-registry-fips< 0.16.6-r2
cadvisor< 0.53.0-r6
cadvisor-compat< 0.53.0-r6
calico-3.29< 3.29.6-r1
calico-apiserver-3.29< 3.29.6-r1
calico-apiserver-compat-3.29< 3.29.6-r1
calico-app-policy-3.29< 3.29.6-r1
calico-cni-3.29< 3.29.6-r1
calico-cni-compat-3.29< 3.29.6-r1
calico-felix-3.29< 3.29.6-r1
calico-key-cert-provisioner-3.29< 3.29.6-r1
calico-kube-controllers-3.29< 3.29.6-r1
calico-node-3.29< 3.29.6-r1
calico-pod2daemon-3.29< 3.29.6-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.6-r1
calico-typha-client-3.29< 3.29.6-r1
calico-typhad-3.29< 3.29.6-r1
calicoctl-3.29< 3.29.6-r1
capslock< 0.2.8-r1
cargobump< 0.1.0-r7
cephcsi-fips< 3.15.0-r3
cert-exporter< 2.16.0-r2
cert-exporter-fips< 2.16.0-r3
cert-manager-cmctl< 2.3.0-r5
cert-manager-webhook-pdns< 2.5.3-r1
cert-manager-webhook-pdns-fips< 2.5.3-r2
certificate-transparency< 1.3.2-r4
certificate-transparency-trillian-ctserver< 1.3.2-r4
cfssl< 1.6.5-r23
cfssl-bundle< 1.6.5-r23
cfssl-bundle-fips< 1.6.5-r16
cfssl-certinfo< 1.6.5-r23
cfssl-certinfo-fips< 1.6.5-r16
cfssl-fips< 1.6.5-r16
cfssl-json< 1.6.5-r23
cfssl-json-fips< 1.6.5-r16
cfssl-mkbundle< 1.6.5-r23
cfssl-mkbundle-fips< 1.6.5-r16
cfssl-multirootca< 1.6.5-r23
cfssl-multirootca-fips< 1.6.5-r16
cfssl-newkey< 1.6.5-r23
cfssl-newkey-fips< 1.6.5-r16
cfssl-scan< 1.6.5-r23
cfssl-scan-fips< 1.6.5-r16
chartmuseum< 0.16.3-r8
chartmuseum-fips< 0.16.3-r6
checksec< 3.0.2-r6
chisel< 1.11.3-r1
chisel-compat< 1.11.3-r1
chisel-fips< 1.11.3-r1
cilium-1.15< 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.19-r3
cilium-1.15-container-init< 1.15.19-r3
cilium-1.15-container-init-compat< 1.15.19-r3
cilium-1.15-hubble-relay< 1.15.19-r3
cilium-1.15-iptables< 1.15.19-r3
cilium-1.15-operator-aws< 1.15.19-r3
cilium-1.15-operator-generic< 1.15.19-r3
cilium-certgen-0.2< 0.2.4-r3
cilium-envoy-fips-1.15< 1.15.19-r6
cilium-fips-1.15< 1.15.19-r7
cilium-fips-1.15-clustermesh-apiserver< 1.15.19-r7
cilium-fips-1.15-container-init< 1.15.19-r7
cilium-fips-1.15-container-init-compat< 1.15.19-r7
cilium-fips-1.15-host-utils< 1.15.19-r7
cilium-fips-1.15-hubble-relay< 1.15.19-r7
cilium-fips-1.15-operator-aws< 1.15.19-r7
cilium-fips-1.15-operator-azure< 1.15.19-r7
cilium-fips-1.15-operator-generic< 1.15.19-r7
cis-operator-1.2< 1.2.7-r5
cloud-provider-aws-1.28< 1.28.11-r40
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r40
cloud-provider-aws-1.28-ecr-credential-provider< 1.28.11-r40
cloud-provider-aws-1.29< 1.29.8-r40
cloud-provider-aws-1.29-cloud-controller-manager< 1.29.8-r40
cloud-provider-aws-1.29-ecr-credential-provider< 1.29.8-r40
cloud-provider-aws-fips-1.28< 1.28.11-r11
cloud-provider-aws-fips-1.28-cloud-controller-manager< 1.28.11-r11
cloud-provider-aws-fips-1.28-ecr-credential-provider< 1.28.11-r11
cloud-provider-aws-fips-1.29< 1.29.8-r11
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.8-r11
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.8-r11
cloud-provider-azure-1.27< 1.27.21-r15
cloud-provider-azure-1.28< 1.28.14-r11
cloud-provider-azure-1.29< 1.29.15-r5
cloud-provider-azure-1.30< 1.30.15-r1
cloud-provider-azure-1.31< 1.31.9-r1
cloud-provider-azure-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.27< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.27-compat< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.28< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.28-compat< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.29< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.29-compat< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.30< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.30-compat< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.31-compat< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.33-compat< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-fips-1.27< 1.27.21-r14
cloud-provider-azure-cloud-controller-manager-fips-1.28< 1.28.14-r10

Show all 200

1 vendor · 200 products · Showing 200 of 2335. Use Open JSON for the complete list.

References

15 links

go.dev/cl/707776WEBFIXPatch
go.dev/issue/75652WEBREPORTIssue Tracking
groups.google.com/g/golang-announce/c/4Emdl2iQ_bIWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2025-4008WEBVendor Advisory
www.openwall.com/lists/oss-security/2025/10/08/1WEBMailing ListRelease NotesThird Party Advisory
ubuntu.com/security/CVE-2025-58189REPORT
www.cve.org/CVERecord?id=CVE-2025-58189REPORT
groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJREPORT
github.com/golang/go/issues/75652REPORT
github.com/golang/go/commit/205d0865958a6d2342939f62dfeaf47508101976REPORT

Show all 15 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities