CVE-2025-61730 — Dependency on Vulnerable Third-Party Component in Standard Library Crypto TLS
Severity
5.3MEDIUMNVD
GHSA7.5
EPSS
0.0%
top 99.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 28
Latest updateFeb 19
Description
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages2 packages
Patches
🔴Vulnerability Details
5CVEList
▶
📋Vendor Advisories
1Debian▶
CVE-2025-61730: golang-1.15 - During the TLS 1.3 handshake if multiple messages are sent in records that span ...↗2025