CVE-2025-61730: Handshake messages may be processed at the incorrect encryption level in crypto/tls

Analyzed

AliasesUBUNTU-CVE-2025-61730DEBIAN-CVE-2025-61730CGA-222w-7m74-h3x2+3169 more

Published 28-01-2026Last modified 02-02-2026

Vulnerability summary

CVE-2025-61730 is a medium (CVSS 5.3) vulnerability in go standard library crypto/tls. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.32%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

28-01-2026
PublishedVulnerability first disclosed.
02-02-2026
Last modifiedVulnerability information updated.

Description

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.33% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r40
actions-runner-controller< 0.13.1-r1
actions-runner-controller-fips< 0.13.1-r1
ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)

agentbeat< 9.2.4-r1
agentbeat-fips< 9.2.4-r1
amass< 5.0.1-r4
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-operator< 3.3.1-r1
amazon-cloudwatch-agent-operator-fips< 3.3.1-r1
amazon-k8s-cni-fipsAll versions (No fix recorded)
amazon-k8s-cni-init-fips< 1.21.1-r3
amazon-k8s-cni-init-fips-compatAll versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r4
amazon-ssm-agent-fips< 3.3.3270.0-r4
amazon-vpc-cni-plugins< 1.3_git20251112-r4
amazon-vpc-cni-plugins-fips< 1.3_git20251112-r4
apache-exporter< 1.0.12-r1
apm-server-7.17< 7.17.29-r8
apm-server-8.17< 8.17.10-r5
apm-server-8.18< 8.18.8-r4
apm-server-8.19< 8.19.10-r1
apm-server-9.0< 9.0.8-r3
apm-server-9.1< 9.1.10-r1
apm-server-fips-7.17< 7.17.29-r8
apm-server-fips-8.17< 8.17.10-r4
apm-server-fips-8.18< 8.18.8-r3
apm-server-fips-8.19< 8.19.10-r1
apm-server-fips-9.0< 9.0.8-r3
argo-cd-2.14< 2.14.21-r5
argo-cd-2.14-compat< 2.14.21-r5
argo-cd-3.0< 3.0.23-r0
argo-cd-3.0-compat< 3.0.23-r0
argo-cd-fips-2.14< 2.14.21-r5
argo-cd-fips-2.14-compat< 2.14.21-r5
argo-rollouts-fips< 1.8.3-r8
auditbeat-8.19< 8.19.10-r1
auditbeat-9.0< 9.0.8-r5
auditbeat-9.1< 9.1.10-r1
auditbeat-9.2< 9.2.4-r1
auditbeat-fips-7< 7.17.29-r9
auditbeat-fips-8.18< 8.18.8-r4
auditbeat-fips-8.19< 8.19.10-r1
auditbeat-fips-9.0< 9.0.8-r4
authservice< 1.1.5-r1
authservice-fips< 1.1.5-r1
aws-ebs-csi-driver-fips-1.50< 1.50.3-r2
aws-ebs-csi-driver-fips-1.51< 1.51.2-r2
aws-ebs-csi-driver-fips-1.52< 1.52.1-r2
aws-ebs-csi-driver-fips-1.53< 1.53.0-r2
aws-eks-pod-identity-agent< 0.1.36-r2
aws-eks-pod-identity-agent-fips< 0.1.36-r2
aws-flb-cloudwatch< 1.9.4-r23
aws-flb-cloudwatch-fips< 1.9.4-r17
aws-flb-kinesis< 1.10.3-r4
aws-flb-kinesis-fips< 1.10.3-r5
aws-fsx-csi-driver< 1.8.0-r1
aws-iam-authenticator< 0.7.10-r1
aws-iam-authenticator-fips< 0.7.10-r1
aws-network-policy-agent-fips< 1.3.1-r1
aws-privateca-issuer< 1.8.0-r1
aws-privateca-issuer-fips< 1.8.0-r1
aws-signer-notation-plugin< 1.0.2292-r5
aws-signer-notation-plugin-fips< 1.0.2292-r5
aws-sigv4-proxy< 1.11-r1
aws-sigv4-proxy-fips< 1.11-r1
azcopy< 10.31.1-r1
azure-aad-pod-identity-mic< 1.8.17-r32
azure-aad-pod-identity-nmi< 1.8.17-r32
azure-ipam< 0.4.0-r8
azure-ipam-dropgzAll versions (No fix recorded)
azure-service-operator< 2.17.0-r1
azure-service-operator-fips< 2.17.0-r1
azure-vnet-cni< 1.7.12-r1
azure-workload-identity-webhook< 1.5.1-r6
azuredisk-csi-1.28< 1.28.12-r12
azuredisk-csi-1.30< 1.30.12-r10
azuredisk-csi-fips-1.29< 1.29.14-r11
azuredisk-csi-fips-1.31< 1.31.12-r6
azurefile-csi-1.29< 1.29.12-r10
azurefile-csi-1.30< 1.30.10-r10
azurefile-csi-1.31< 1.31.8-r6
azurefile-csi-1.32< 1.32.9-r1
azurefile-csi-1.33< 1.33.7-r1
azurefile-csi-1.34< 1.34.3-r1
azurefile-csi-fips-1.29< 1.29.12-r10
azurefile-csi-fips-1.31< 1.31.8-r6
azurefile-csi-fips-1.32< 1.32.9-r1
azurefile-csi-fips-1.34< 1.34.3-r1
bank-vaults-template< 1.32.1-r1
bento< 1.14.1-r1
blob-csi-1.23< 1.23.11-r63
blob-csi-1.24< 1.24.11-r12
blob-csi-fips-1.23< 1.23.11-r64
blob-csi-fips-1.24< 1.24.11-r12
blob-csi-fips-1.25< 1.25.10-r7
blobfuse2< 2.4.2-r8
blobfuse2-fips-health-monitorAll versions (No fix recorded)
bom< 0.7.1-r4
boring-registry< 0.16.6-r5
boring-registry-fips< 0.16.6-r5
boringssl-fips-static-2023042800-toolsAll versions (No fix recorded)
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildtools-buildifier-fipsAll versions (No fix recorded)
buildtools-buildozer-fipsAll versions (No fix recorded)
cadvisor-fips< 0.56.2-r1
calico-apiserver-3.29< 3.29.7-r5
calico-app-policy-3.29< 3.29.7-r5
calico-app-policy-3.31< 3.31.3-r2
calico-cni-3.29< 3.29.7-r5
calico-felix-3.29< 3.29.7-r5
calico-felix-3.31< 3.31.3-r2
calico-key-cert-provisioner-3.29< 3.29.7-r5
calico-key-cert-provisioner-fips-3.31< 3.31.3-r2
calico-kube-controllers-3.29< 3.29.7-r5
calico-kube-controllers-fips-3.31< 3.31.3-r2
calico-node-3.29< 3.29.7-r5
calico-pod2daemon-3.29< 3.29.7-r5
calico-pod2daemon-fips-3.31All versions (No fix recorded)
calico-typha-client-3.29< 3.29.7-r5
calico-typha-client-fips-3.31< 3.31.3-r2
calico-typhad-3.29< 3.29.7-r5
calico-whisker-backend-fips-3.31< 3.31.3-r2
calicoctl-3.29< 3.29.7-r5
calicoctl-3.31< 3.31.3-r2
calicoctl-fips-3.31< 3.31.3-r2
capslockAll versions (No fix recorded)
cargobumpAll versions (No fix recorded)
cass-operator< 1.28.0-r3
cass-operator-fips< 1.28.0-r4
ceph-csi-operator< 0.4.1-r3
ceph-csi-operator-fips< 0.4.1-r2
cephcsi< 3.16.1-r0
cephcsi-fips< 3.16.1-r0
cerbos-fips< 0.51.0-r0
cerbosctl-fips< 0.51.0-r0
cert-manager-acmesolver-fips-1.19< 1.19.2-r1
cert-manager-cainjector-fips-1.19< 1.19.2-r1
cert-manager-cmctl< 2.4.0-r2
cert-manager-cmctl-fips< 2.4.0-r2
cert-manager-controller-fips-1.19< 1.19.2-r1
cert-manager-csi-driver-fips< 0.12.0-r1
cert-manager-fips-1.17< 1.17.4-r6
cert-manager-google-cas-issuer< 0.10.2-r1
cert-manager-istio-csr< 0.15.0-r1
cert-manager-istio-csr-fips< 0.15.0-r1
cert-manager-openshift-routes< 0.8.4-r1
cert-manager-openshift-routes-fips< 0.8.4-r1
cert-manager-startupapicheck-fips-1.19< 1.19.2-r1
cert-manager-webhook-fips-1.19< 1.19.2-r1
cert-manager-webhook-pdns-fips< 2.5.3-r5
cfssl< 1.6.5-r26
cfssl-bundle< 1.6.5-r26
chaos-mesh-fips< 2.8.1-r1
chart-testing< 3.14.0-r3
chart-testing-fips< 3.14.0-r3
chisel< 1.11.3-r4
chisel-fips< 1.11.3-r4
cilium-certgen-0.1< 0.1.20-r3
cilium-cli< 0.19.0-r1
cilium-envoy-1.16< 1.16.19-r1
cilium-envoy-fips-1.15< 1.15.19-r8
cilium-envoy-fips-1.16< 1.16.19-r1
cis-operator-1.2< 1.2.7-r7
cis-operator-1.3< 1.3.10-r2
clickhouse-operator-fips-metrics-exporter< 0.25.6-r1
clickhouse-operator-metrics-exporter< 0.25.6-r1
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r42
cloud-provider-aws-1.29-ecr-credential-provider< 1.29.10-r3
cloud-provider-aws-1.31-cloud-controller-manager< 1.31.9-r2
cloud-provider-aws-1.32-cloud-controller-manager< 1.32.5-r3
cloud-provider-aws-1.32-ecr-credential-provider< 1.32.5-r3
cloud-provider-aws-1.33-cloud-controller-manager< 1.33.2-r4
cloud-provider-aws-1.33-ecr-credential-provider< 1.33.2-r4
cloud-provider-aws-1.34-cloud-controller-manager< 1.34.1-r4
cloud-provider-aws-fips-1.28-ecr-credential-provider< 1.28.11-r13
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.10-r3
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.10-r3
cloud-provider-aws-fips-1.31-cloud-controller-manager< 1.31.9-r3
cloud-provider-aws-fips-1.31-ecr-credential-provider< 1.31.9-r3
cloud-provider-aws-fips-1.32-cloud-controller-manager< 1.32.5-r3
cloud-provider-aws-fips-1.32-ecr-credential-provider< 1.32.5-r3
cloud-provider-aws-fips-1.33-cloud-controller-manager< 1.33.2-r3
cloud-provider-aws-fips-1.33-ecr-credential-provider< 1.33.2-r3
cloud-provider-aws-fips-1.34-cloud-controller-manager< 1.34.1-r4
cloud-provider-aws-fips-1.34-ecr-credential-provider< 1.34.1-r4
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.12-r3
cloud-provider-azure-cloud-controller-manager-1.32< 1.32.11-r2
cloud-provider-azure-cloud-controller-manager-1.33< 1.33.6-r2
cloud-provider-azure-cloud-controller-manager-1.34< 1.34.3-r3
cloud-provider-azure-cloud-controller-manager-fips-1.27< 1.27.21-r17
cloud-provider-azure-cloud-controller-manager-fips-1.28< 1.28.14-r13
cloud-provider-azure-cloud-controller-manager-fips-1.29< 1.29.15-r7
cloud-provider-azure-cloud-controller-manager-fips-1.30< 1.30.15-r4
cloud-provider-azure-cloud-controller-manager-fips-1.31< 1.31.12-r3
cloud-provider-azure-cloud-controller-manager-fips-1.34< 1.34.3-r3

Show all 199

Alpine1 product

go≥ 1.25.0, < 1.24.12-r0 | ≥ 1.25.0, < 1.25.6-r0

2 vendors · 200 products · Showing 200 of 1949

References

12 links

go.dev/cl/724120WEBFIXPatch
go.dev/issue/76443WEBREPORTPatch
groups.google.com/g/golang-announce/c/Vd2tYVM8eUcREPORTWEBRelease Notes
pkg.go.dev/vuln/GO-2026-4340WEBVendor Advisory
ubuntu.com/security/CVE-2025-61730REPORT
www.cve.org/CVERecord?id=CVE-2025-61730REPORT
github.com/golang/go/issues/76443REPORT
security-tracker.debian.org/tracker/CVE-2025-61730Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61730.jsonAdvisory

Show all 12 references

nvd.nist.gov/vuln/detail/CVE-2025-61730AdvisoryOval
security.alpinelinux.org/vuln/CVE-2025-61730Advisory