CVE-2026-42505
Vulnerability Summary
Timeline
Description
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Trends
Current EPSS score: 0.38%• Percentile: 32%
Techniques & Countermeasures
- CWE-201•Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Affected Systems
- chainguard•actionlint
< 0
- chainguard•actions-runner-controller
< 0.14.2-r5
- chainguard•actions-runner-controller-fips
< 0.14.2-r4
- chainguard•addon-resizer
< 1.8.23-r26
- chainguard•addon-resizer-fips
< 1.8.23-r21
- chainguard•age-fips
< 0 | < 1.3.1-r15
- chainguard•agentbeat
< 9.2.7-r16
- chainguard•agentbeat-fips
< 9.2.7-r15
- chainguard•amass
< 5.1.1-r8
- chainguard•amazon-cloudwatch-agent
< 1.300070.0-r3
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 0
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-translator
< 0
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 0
- chainguard•amazon-cloudwatch-agent-fips
< 1.300070.0-r6
- chainguard•amazon-cloudwatch-agent-operator
< 3.5.0-r5
- chainguard•amazon-cloudwatch-agent-operator-fips
< 3.5.0-r4
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 0
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-ecs-agent
< 1.105.0-r2
- chainguard•amazon-ecs-agent-fips
< 1.105.0-r1
- chainguard•amazon-ecs-cni-plugins-fips
< 2024.9.0_git20260617-r3
- chainguard•amazon-eks-ami
< 20260625-r1
- chainguard•amazon-eks-ami-fips
< 20260625-r2
- chainguard•amazon-k8s-cni
< 0 | < 1.22.3-r1
- chainguard•amazon-k8s-cni-fips
< 0 | < 1.22.3-r1
- chainguard•amazon-k8s-cni-init
< 1.22.3-r1
- chainguard•amazon-k8s-cni-init-fips
< 1.22.3-r1
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.22.3-r1
- chainguard•amazon-ssm-agent
< 3.3.4793.0-r1
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.4793.0-r1
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 3.3.4793.0-r2
- chainguard•amazon-ssm-agent-fips
< 3.3.4793.0-r2
- chainguard•amazon-vpc-cni-plugins-fips
< 1.3_git20260619-r2
- chainguard•ansible-operator
< 1.42.3-r3
- chainguard•ansible-operator-fips
< 1.42.3-r1
- chainguard•apache-beam-java-11-sdk
< 0
- chainguard•apache-beam-java-17-sdk
< 0
- chainguard•apache-beam-java-21-sdk
< 0
- chainguard•apache-beam-python-3.11-sdk
< 0
- chainguard•apache-beam-python-3.13-sdk
< 0
- chainguard•apache-exporter
< 1.1.1-r1
- chainguard•apiserver-network-proxy-fips-0.34
< 0.34.0-r3
- chainguard•apiserver-network-proxy-fips-0.34-agent
< 0.34.0-r3
- chainguard•apiserver-network-proxy-fips-0.35
< 0.35.0-r2
- chainguard•apiserver-network-proxy-fips-0.35-agent
< 0.35.0-r2
- chainguard•apiserver-network-proxy-fips-0.36
< 0.36.0-r3
- chainguard•apiserver-network-proxy-fips-0.36-agent
< 0.36.0-r3
Showing first 50 affected entries in server-rendered view.
References (9)
- https://go.dev/cl/775960
- https://go.dev/issue/79282
- https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
- https://pkg.go.dev/vuln/GO-2026-5856
- https://security-tracker.debian.org/tracker/CVE-2026-42505
- https://www.suse.com/security/cve/CVE-2026-42505
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42505.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-42505