CVE-2025-61730

low-risk
Published 2026-01-28

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Go

Affected Vendors

Golang

References (4)

Patch https://go.dev/cl/724120
Patch https://go.dev/issue/76443
Release Notes https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
Vendor Advisory https://pkg.go.dev/vuln/GO-2026-4340
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal