CVE-2025-61730: Handshake messages may be processed at the incorrect encryption level in crypto/tls
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61730?
CVE-2025-61730 has been classified with a severity rating that may impact the confidentiality and integrity of data during TLS 1.3 handshakes.
How do I fix CVE-2025-61730?
To fix CVE-2025-61730, update to the latest version of the Go crypto/tls library that addresses this vulnerability.
What systems are affected by CVE-2025-61730?
CVE-2025-61730 affects software using the Go crypto/tls library during TLS 1.3 handshakes.
What is the nature of the flaw in CVE-2025-61730?
CVE-2025-61730 involves incorrect processing of handshake messages at different encryption levels during the TLS 1.3 handshake.
Can CVE-2025-61730 lead to data breaches?
Yes, CVE-2025-61730 can potentially lead to unauthorized access to sensitive data due to improper encryption handling.