CVE-2025-68121: Unexpected session resumption in crypto/tls

Modified

AliasesRHSA-2026:17686RHSA-2026:3842RHSA-2026:6552+6561 more

Published 05-02-2026Last modified 29-04-2026

Vulnerability summary

CVE-2025-68121 is a critical (CVSS 10.0) Improper Certificate Validation vulnerability in go standard library crypto/tls. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.7% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

Critical · v3.1 (NVD)

EPSS score

0.90%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 165 · Related 164

MGASA-2026-0035 MGASA-2026-0147 OPENSUSE-SU-2026:10063-1 OPENSUSE-SU-2026:10064-1 OPENSUSE-SU-2026:10220-1 OPENSUSE-SU-2026:10329-1+94 more

Showing 100 of 166.

Timeline

05-02-2026
PublishedVulnerability first disclosed.
29-04-2026
Last modifiedVulnerability information updated.

Description

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

CVSS metrics

8 scores · 8 sources · 1 version

v3.110.0

EPSS trend

Probability

0.90%

Chance of exploitation in the next 30 days

Percentile

60%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.92% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (go.dev)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r40
actions-runner-controller< 0.13.1-r2
actions-runner-controller-fips< 0.13.1-r3
addon-resizer< 1.8.23-r13
addon-resizer-fips< 1.8.23-r15

ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)
agentbeat< 9.2.4-r2
agentbeat-fips< 9.2.4-r2
amass< 5.0.1-r6
amazon-cloudwatch-agent-operator< 3.3.1-r2
amazon-cloudwatch-agent-operator-fips< 3.3.1-r3
amazon-ecs-agent< 1.101.3-r0
amazon-ecs-agent-fips< 1.101.3-r0
amazon-ecs-cni-plugins< 2024.9.0_git20260129-r2
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260129-r4
amazon-eks-ami< 20260129-r2
amazon-eks-ami-fips< 20260129-r1
amazon-k8s-cniAll versions (No fix recorded)
amazon-k8s-cni-fipsAll versions (No fix recorded)
amazon-k8s-cni-init< 1.21.1-r4
amazon-k8s-cni-init-fips< 1.21.1-r4
amazon-k8s-cni-init-fips-compatAll versions (No fix recorded)
amazon-ssm-agent< 3.3.3270.0-r5
amazon-ssm-agent-ecs-exec< 3.3.3270.0-r5
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r5
amazon-vpc-cni-plugins< 1.3_git20251112-r5
amazon-vpc-cni-plugins-fips< 1.3_git20251112-r6
ansible-operator< 1.42.0-r7
ansible-operator-fips< 1.42.0-r5
apache-beam-java-11-sdkAll versions (No fix recorded)
apache-beam-java-17-sdkAll versions (No fix recorded)
apache-beam-java-21-sdkAll versions (No fix recorded)
apache-exporter< 1.0.12-r2
apisix-ingress-controller< 2.0.1-r4
apm-server-7.17< 7.17.29-r10
apm-server-8.17< 8.17.10-r5
apm-server-8.19< 8.19.11-r1
apm-server-9.0< 9.0.8-r3
apm-server-9.1< 9.1.10-r1
apm-server-9.2< 9.2.5-r1
apm-server-fips-7.17< 7.17.29-r9
apm-server-fips-8.19< 8.19.11-r1
apm-server-fips-9.0< 9.0.8-r4
apm-server-fips-9.1< 9.1.10-r1
apm-server-fips-9.2< 9.2.5-r1
argo-cd-2.13< 2.13.9-r8
argo-cd-2.13-compat< 2.13.9-r8
argo-cd-2.14< 2.14.21-r7
argo-cd-2.14-compat< 2.14.21-r7
argo-cd-3.0< 3.0.23-r1
argo-cd-3.0-compat< 3.0.23-r1
argo-cd-3.1< 3.1.12-r2
argo-cd-3.1-compat< 3.1.12-r2
argo-cd-3.2< 3.2.6-r1
argo-cd-3.2-compat< 3.2.6-r1
argo-cd-fips-2.14< 2.14.21-r7
argo-cd-fips-2.14-compat< 2.14.21-r7
argo-cd-fips-3.0< 3.0.23-r2
argo-cd-fips-3.0-compat< 3.0.23-r2
argo-cd-fips-3.1< 3.1.12-r2
argo-cd-fips-3.1-compat< 3.1.12-r2
argo-cd-fips-3.2< 3.2.6-r2
argo-cd-fips-3.2-compat< 3.2.6-r2
argo-events< 1.9.10-r2
argo-events-fips< 1.9.10-r2
argo-rollouts< 1.8.3-r8
argo-rollouts-fips< 1.8.3-r9
argo-workflow-controller-3.6< 3.6.18-r2
argo-workflow-controller-3.7< 3.7.9-r1
argo-workflow-executor-3.6< 3.6.18-r2
argo-workflow-executor-3.7< 3.7.9-r1
argo-workflows-3.6< 3.6.18-r2
argo-workflows-3.7< 3.7.9-r1
argocd-image-updater-fips< 1.1.0-r1
atlantis< 0.40.0-r1
atlantis-fips< 0.40.0-r2
auditbeat-7< 7.17.29-r9
auditbeat-8.17< 8.17.10-r7
auditbeat-8.18< 8.18.8-r8
auditbeat-9.0< 9.0.8-r6
auditbeat-9.1< 9.1.10-r2
auditbeat-9.2< 9.2.5-r0
auditbeat-fips-7< 7.17.29-r9
auditbeat-fips-8.17< 8.17.10-r5
auditbeat-fips-8.18< 8.18.8-r5
auditbeat-fips-8.19< 8.19.11-r0
auditbeat-fips-9.0< 9.0.8-r5
auditbeat-fips-9.1< 9.1.10-r2
auditbeat-fips-9.2< 9.2.5-r0
authentik-go-server-fips< 2025.12.1-r3
authservice< 1.1.5-r3
authservice-fips< 1.1.5-r2
aws-application-networking-k8s< 2.0.0-r2
aws-application-networking-k8s-fips< 2.0.0-r2
aws-ebs-csi-driver-1.49< 1.49.2-r3
aws-ebs-csi-driver-1.50< 1.50.3-r3
aws-ebs-csi-driver-1.51< 1.51.2-r3
aws-ebs-csi-driver-1.52< 1.52.1-r4
aws-ebs-csi-driver-1.53< 1.53.0-r3
aws-ebs-csi-driver-1.54< 1.54.0-r3
aws-ebs-csi-driver-1.55< 1.55.0-r1
aws-ebs-csi-driver-fips-1.49< 1.49.2-r3
aws-ebs-csi-driver-fips-1.50< 1.50.3-r3
aws-ebs-csi-driver-fips-1.51< 1.51.2-r3
aws-ebs-csi-driver-fips-1.52< 1.52.1-r3
aws-ebs-csi-driver-fips-1.53< 1.53.0-r3
aws-ebs-csi-driver-fips-1.54< 1.54.0-r2
aws-ebs-csi-driver-fips-1.55< 1.55.0-r1
aws-efs-csi-driver< 2.3.0-r2
aws-efs-csi-driver-fips< 2.3.0-r2
aws-eks-pod-identity-agent< 0.1.36-r5
aws-eks-pod-identity-agent-fips< 0.1.36-r3
aws-flb-cloudwatch< 1.9.4-r25
aws-flb-cloudwatch-fips< 1.9.4-r20
aws-flb-firehose< 1.7.2-r24
aws-flb-firehose-fips< 1.7.2-r19
aws-flb-kinesis< 1.10.3-r6
aws-flb-kinesis-fips< 1.10.3-r7
aws-fsx-csi-driver< 1.8.0-r2
aws-fsx-csi-driver-fips< 1.8.0-r2
aws-iam-authenticator< 0.7.10-r3
aws-iam-authenticator-fips< 0.7.10-r2
aws-load-balancer-controller< 3.0.0-r1
aws-load-balancer-controller-fips< 3.0.0-r2
aws-network-policy-agent< 1.3.1-r2
aws-network-policy-agent-fips< 1.3.1-r2
aws-node-termination-handler< 1.25.4-r2
aws-node-termination-handler-fips< 1.25.4-r1
aws-otel-collector-fips< 0.47.0-r1
aws-otel-collector-healthcheck< 0.47.0-r1
aws-otel-collector-healthcheck-fips< 0.47.0-r1
aws-privateca-issuer< 1.8.0-r4
aws-privateca-issuer-fips< 1.8.0-r3
aws-s3-controller< 1.3.0-r1
aws-signer-notation-plugin< 1.0.2292-r8
aws-signer-notation-plugin-fips< 1.0.2292-r6
aws-sigv4-proxy< 1.11-r3
aws-sigv4-proxy-fips< 1.11-r2
azcopy< 10.32.0-r1
azcopy-fips< 10.32.0-r1
azure-aad-pod-identity-mic< 1.8.17-r33
azure-aad-pod-identity-nmi< 1.8.17-r33
azure-ipam< 0.4.0-r10
azure-service-operator< 2.17.0-r2
azure-service-operator-fips< 2.17.0-r2
azure-vnet-cni< 1.7.12-r2
azure-workload-identity-webhook< 1.5.1-r7
azuredisk-csi-1.28< 1.28.12-r14
azuredisk-csi-1.29< 1.29.14-r13
azuredisk-csi-1.30< 1.30.12-r11
azuredisk-csi-1.31< 1.31.12-r7
azuredisk-csi-1.32< 1.32.12-r1
azuredisk-csi-1.33< 1.33.8-r2
azuredisk-csi-1.34< 1.34.1-r1
azuredisk-csi-fips-1.28< 1.28.12-r12
azuredisk-csi-fips-1.29< 1.29.14-r12
azuredisk-csi-fips-1.30< 1.30.12-r10
azuredisk-csi-fips-1.31< 1.31.12-r7
azuredisk-csi-fips-1.32< 1.32.12-r1
azuredisk-csi-fips-1.33< 1.33.8-r2
azuredisk-csi-fips-1.34< 1.34.1-r1
azurefile-csi-1.29< 1.29.12-r11
azurefile-csi-1.30< 1.30.10-r11
azurefile-csi-1.31< 1.31.8-r7
azurefile-csi-1.32< 1.32.9-r3
azurefile-csi-1.33< 1.33.7-r2
azurefile-csi-fips-1.29< 1.29.12-r11
azurefile-csi-fips-1.30< 1.30.10-r11
azurefile-csi-fips-1.31< 1.31.8-r7
azurefile-csi-fips-1.32< 1.32.9-r2
azurefile-csi-fips-1.33< 1.33.7-r2
azurefile-csi-fips-1.34< 1.34.3-r2
backup-restore-operator-7.0< 7.0.5-r1
backup-restore-operator-8.1< 8.1.2-r1
backup-restore-operator-9.0< 9.0.1-r1
backup-restore-operator-fips-7.0< 7.0.5-r1
backup-restore-operator-fips-8.1< 8.1.2-r1
backup-restore-operator-fips-9.0< 9.0.1-r1
bank-vaults< 1.32.1-r2
bank-vaults-fips< 1.20.4-r38
bank-vaults-template< 1.32.1-r2
bank-vaults-template-fips< 1.20.4-r38
bazelisk< 1.28.1-r1
blob-csi-1.23< 1.23.11-r64
blob-csi-1.24< 1.24.11-r13
blob-csi-1.25< 1.25.10-r9
blob-csi-1.26< 1.26.9-r2
blob-csi-1.27< 1.27.2-r1
blob-csi-fips-1.23< 1.23.11-r65
blob-csi-fips-1.24< 1.24.11-r13
blob-csi-fips-1.25< 1.25.10-r8
blob-csi-fips-1.26< 1.26.9-r1
blob-csi-fips-1.27< 1.27.2-r1
blobfuse2-fips< 2.4.2-r10
blobfuse2-fips-health-monitorAll versions (No fix recorded)
blobfuse2-health-monitorAll versions (No fix recorded)
bom< 0.7.1-r5

Show all 198

Alpine2 products

go≥ 1.25.0, < 1.24.13-r0 | ≥ 1.25.0, < 1.25.7-r0
rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 3545

References

23 links

groups.google.com/g/golang-announce/c/K09ubi9FQFkARTICLEWEBMailing ListThird Party Advisory
go.dev/cl/737700ARTICLEWEBFIXPatch
go.dev/issue/77217ARTICLEWEBREPORTExploitIssue Tracking
pkg.go.dev/vuln/GO-2026-4337AdvisoryWEBVendor Advisory
access.redhat.com/errata/RHSA-2026:17686Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2437111REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17686.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-68121REPORT
www.cve.org/CVERecord?id=CVE-2025-68121AdvisoryREPORT

Show all 23 references