During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Go Standard Library |
|
No data.
No data.
References
History
Thu, 29 Jan 2026 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 29 Jan 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go Standard Library
Go Standard Library crypto Tls |
|
| Vendors & Products |
Go Standard Library
Go Standard Library crypto Tls |
Wed, 28 Jan 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake. | |
| Title | Handshake messages may be processed at the incorrect encryption level in crypto/tls | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Go
Published: 2026-01-28T19:30:30.986Z
Updated: 2026-01-29T18:33:18.399Z
Reserved: 2025-09-30T15:05:03.605Z
Link: CVE-2025-61730
Vulnrichment
Updated: 2026-01-29T18:33:11.041Z
NVD
Status : Awaiting Analysis
Published: 2026-01-28T20:16:09.940
Modified: 2026-01-29T19:16:16.533
Link: CVE-2025-61730
Redhat
No data.