Skip to content

crypto/tls: ALPN negotiation error contains attacker controlled information #75652

Closed
Closed
crypto/tls: ALPN negotiation error contains attacker controlled information#75652
Labels
FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Security
Milestone
Go1.26

Description

@rolandshoemaker
rolandshoemaker
opened on Sep 29, 2025

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. We expect most logging software filters control characters and such, so the impact for this is relatively limited, hence we are treating this as a PUBLIC track issue, per the Go Security Policy (https://go.dev/security/policy).

This is CVE-2025-58189.

Activity

  1. Imagerolandshoemaker
    added
    Security
    on Sep 29, 2025

  2. gopherbot commented on Sep 29, 2025

    @gopherbot
    gopherbot
    on Sep 29, 2025
    Contributor

    Change https://go.dev/cl/707776 mentions this issue: crypto/tls: quote protocols in ALPN error message

  3. Imagegopherbot
    closed this as completedin 4e9006aon Sep 29, 2025
  4. Imagepull
    added a commit that references this issue on Sep 29, 2025

    crypto/tls: quote protocols in ALPN error message

    4e9006a

  5. rolandshoemaker commented on Sep 30, 2025

    @rolandshoemaker
    rolandshoemaker
    on Sep 30, 2025
    MemberAuthor

    @gopherbot please open backport issues.

  6. gopherbot commented on Sep 30, 2025

    @gopherbot
    gopherbot
    on Sep 30, 2025
    Contributor

    Backport issue(s) opened: #75660 (for 1.24), #75661 (for 1.25).

    Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

  7. gopherbot commented on Sep 30, 2025

    @gopherbot
    gopherbot
    on Sep 30, 2025
    Contributor

    Change https://go.dev/cl/708095 mentions this issue: [release-branch.go1.25] crypto/tls: quote protocols in ALPN error message

  8. gopherbot commented on Sep 30, 2025

    @gopherbot
    gopherbot
    on Sep 30, 2025
    Contributor

    Change https://go.dev/cl/708096 mentions this issue: [release-branch.go1.24] crypto/tls: quote protocols in ALPN error message

  9. Imagedmitshur
    added
    NeedsFixThe path to resolution is known, but the work has not been done.
    on Sep 30, 2025
  10. Imagedmitshur
    added this to the Go1.26 milestone on Sep 30, 2025
  11. Imagegopherbot
    added 2 commits that reference this issue on Oct 1, 2025

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    2e1e356

    [release-branch.go1.25] crypto/tls: quote protocols in ALPN error mes…

    205d086
  12. Imagerickystewart
    added 8 commits that reference this issue on Oct 8, 2025

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    1592202

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    ac2bc7a

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    ed1fae8

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    84fef0d

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    f280256

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    ec86954

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    e470d18

    [release-branch.go1.24] crypto/tls: quote protocols in ALPN error mes…

    b252907
  13. Imagelxq015
    added a commit that references this issue on Dec 10, 2025

    [release-branch.go1.25] crypto/tls: quote protocols in ALPN error mes…

    d132176
  14. Imagelxq015
    added a commit that references this issue on Mar 19, 2026

    [release-branch.go1.25] crypto/tls: quote protocols in ALPN error mes…

    4d8c138
  15. Imagegolang
    locked and limited conversation to collaborators on Sep 30, 2026
  16. Imagegopherbot
    added
    FrozenDueToAge
    on Sep 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Security

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions