CVE-2026-42505
published 2026-07-08CVE-2026-42505: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.38%
31.6th percentile
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
Affected
110 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-rhel7-operator | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-26 | receptor-rhel9 | — | — |
| ansible-automation-platform-27 | receptor-rhel9 | — | — |
| ansible-automation-platform | platform-operator-bundle | — | — |
| build-of-trustee | trustee-rhel9-operator | — | — |
| buildah_project | buildah | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| compliance | openshift-compliance-operator-bundle | — | — |
| compliance | openshift-selinuxd-rhel8 | — | — |
| confidential-containers | trustee | — | — |
| container-native-virtualization | kubevirt-apiserver-proxy-rhel9 | — | — |
| container-native-virtualization | kubevirt-redfish-rhel9 | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| cryostat | cryostat-storage-rhel9 | — | — |
| custom-metrics-autoscaler | custom-metrics-autoscaler-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| devworkspace | devworkspace-rhel9-operator | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
ghsa_unreviewed·2026-07-08
CVE-2026-42505 [MEDIUM] CWE-201 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
VulDB
Go standard library crypto-tls up to 1.25.11/1.26.4 TLS Handshake insertion of sensitive information into sent data (Nessus ID 325629)
vuldb·2026-07-08·CVSS 5.3
CVE-2026-42505 [MEDIUM] Go standard library crypto-tls up to 1.25.11/1.26.4 TLS Handshake insertion of sensitive information into sent data (Nessus ID 325629)
A vulnerability, which was classified as problematic, was found in Go standard library crypto-tls up to 1.25.11/1.26.4. This impacts an unknown function of the component TLS Handshake. Executing a manipulation can lead to insertion of sensitive information into sent data.
The identification of this vulnerability is CVE-2026-42505. The attack may be launched remotely. There is no exploit available.
Red Hat
crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello
vendor_redhat·2026-07-08·CVSS 5.3
CVE-2026-42505 [MEDIUM] CWE-201 crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello
crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.
Statement: This Moderate-impact information disclosure flaw in the Go `crypto/tls` package allows a passive network observer to de-anonymize connections utilizing Encrypted Client Hello (ECH). The vulnerability stems fr
No detection rules found.
No public exploits indexed.
2026-07-08
Published