CVE-2025-58189

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
GoCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
trixie
no-dsa
bookworm
no-dsa
golang-1.19
bookworm
vulnerable
trixie
no-dsa
golang-1.24
trixie
no-dsa
bookworm
no-dsa
forky
1.24.9-1
fixed
sid
1.24.9-1
fixed
golang-1.25
forky
1.25.3-1
fixed
sid
1.25.3-1
fixed
trixie
no-dsa
bookworm
no-dsa
Vulnerability Media Exposure
References
https://go.dev/cl/707776
https://go.dev/issue/75652
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
https://pkg.go.dev/vuln/GO-2025-4008