DEBIAN-CVE-2025-61730

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2025-61730
Published: 28 Jan 2026, 20:16
Last modified:28 Apr 2026, 20:30

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Jan 2026, 20:16
Published
Vulnerability first disclosed
28 Apr 2026, 20:30
Last Modified
Vulnerability information updated

Description

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Systems

  • debian•golang-1.15

    all

  • debian•golang-1.19

    all

  • debian•golang-1.24

    all | < 1.24.12-1 | all

  • debian•golang-1.25

    all | < 1.25.6-1

References (1)