CVE-2025-68121: Unexpected session resumption in crypto/tls
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Avoid mutating a crypto/tls *Config (specifically ClientCAs and RootCAs) between the initial TLS handshake and any subsequent resumed handshake; if you need a different CA set, create a separate Config and ensure it is not changed after the session is established.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68121?
CVE-2025-68121 has a moderate severity due to potential unauthorized session resumption.
How do I fix CVE-2025-68121?
To fix CVE-2025-68121, update your Golang version to 1.26.0 or later, ensuring the ClientCAs and RootCAs configurations are correctly set before the handshake.
What versions of Golang are affected by CVE-2025-68121?
CVE-2025-68121 affects Golang versions prior to 1.26.0, including versions up to 1.24.13 and between 1.25.0 and 1.25.7.
What impact does CVE-2025-68121 have on application security?
CVE-2025-68121 can lead to unauthorized access during session resumption if CA configurations are modified between handshakes.
Is there a workaround for CVE-2025-68121?
A temporary workaround for CVE-2025-68121 is to avoid mutating the ClientCAs or RootCAs fields between handshakes until an update can be applied.