Vulnerability · Published Feb 5, 2026 · Assigned by Go

CVE-2025-68121Unexpected session resumption in crypto/tls

Critical 9.1

In plain English

A critical-severity improper certificate validation in crypto/tls from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.9%top 40.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:10buildah2:1.41.8-2.el10_1ALSA-2026:3297
AlmaLinux:8buildah2:1.33.14-3.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9buildah2:1.41.8-2.el9_7ALSA-2026:3298
AlmaLinux:10buildah-tests2:1.41.8-2.el10_1ALSA-2026:3297
AlmaLinux:8buildah-tests2:1.33.14-3.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9buildah-tests2:1.41.8-2.el9_7ALSA-2026:3298
AlmaLinux:8cockpit-podman84.1-1.module_el8.10.0+4102+6c76e544ALSA-2026:4672
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+4090+91932338ALSA-2026:4672
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8container-selinux2:2.229.0-2.module_el8.10.0+4090+91932338ALSA-2026:4672
AlmaLinux:8containernetworking-plugins1:1.4.0-8.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9containernetworking-plugins1:1.7.1-3.el9_7ALSA-2026:3341
AlmaLinux:9containernetworking-plugins1:1.9.0-2.el9ALSA-2026:18913
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3876+e55593a8ALSA-2026:4672
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+3858+6ad51f9fALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3926+f12484f5ALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4102+6c76e544ALSA-2026:4672
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:10delve1.25.2-2.el10_1ALSA-2026:3864
AlmaLinux:10delve1.26.1-1.el10_2ALSA-2026:19013
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2026:2708
AlmaLinux:9delve1.25.2-2.el9_7ALSA-2026:3842
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3792+03eaed9cALSA-2026:4672
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:10git-lfs3.6.1-7.el10_1ALSA-2026:4164
AlmaLinux:8git-lfs3.4.1-8.el8_10ALSA-2026:3985
AlmaLinux:9git-lfs3.6.1-7.el9_7ALSA-2026:3928
AlmaLinux:10go-fdo-client1.0.0-4.el10_2ALSA-2026:22141
AlmaLinux:10go-fdo-server1.0.1-2.el10_2ALSA-2026:22141
AlmaLinux:10go-fdo-server-manufacturer1.0.1-2.el10_2ALSA-2026:22141
AlmaLinux:10go-fdo-server-owner1.0.1-2.el10_2ALSA-2026:22141
AlmaLinux:10go-fdo-server-rendezvous1.0.1-2.el10_2ALSA-2026:22141
AlmaLinux:8go-toolset1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9go-toolset1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang-bin1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-bin1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-docs1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-docs1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-docs1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-misc1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-misc1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-misc1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang-race1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-race1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-src1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-src1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-src1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-tests1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-tests1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-tests1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10grafana10.2.6-22.el10_1ALSA-2026:2914
AlmaLinux:8grafana9.2.10-28.el8_10ALSA-2026:3188
AlmaLinux:9grafana10.2.6-18.el9_7ALSA-2026:2920
AlmaLinux:10grafana-pcp5.3.0-2.el10_1ALSA-2026:3035
AlmaLinux:8grafana-pcp5.1.1-12.el8_10ALSA-2026:3187
AlmaLinux:9grafana-pcp5.1.1-12.el9_7ALSA-2026:3040
AlmaLinux:10grafana-selinux10.2.6-22.el10_1ALSA-2026:2914
AlmaLinux:8grafana-selinux9.2.10-28.el8_10ALSA-2026:3188
AlmaLinux:9grafana-selinux10.2.6-18.el9_7ALSA-2026:2920
AlmaLinux:10image-builder31-4.el10_1ALSA-2026:3840
AlmaLinux:9image-builder31-3.el9_7ALSA-2026:3839
AlmaLinux:10ipp-usb0.9.27-5.el10_1ALSA-2026:3092
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4090+91932338ALSA-2026:4672
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4023+db236c53ALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4102+6c76e544ALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4023+db236c53ALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:10opentelemetry-collector0.144.0-1.el10_1ALSA-2026:4174
AlmaLinux:9opentelemetry-collector0.144.0-1.el9_7ALSA-2026:4177
AlmaLinux:10osbuild-composer149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:8osbuild-composer101.4-4.el8_10.alma.1ALSA-2026:3898
AlmaLinux:9osbuild-composer149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:10osbuild-composer-core149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:8osbuild-composer-core101.4-4.el8_10.alma.1ALSA-2026:3898
AlmaLinux:9osbuild-composer-core149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:10osbuild-composer-worker149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:8osbuild-composer-worker101.4-4.el8_10.alma.1ALSA-2026:3898
AlmaLinux:9osbuild-composer-worker149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:8podman4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-catatonit4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:10podman-docker7:5.6.0-12.el10_1.alma.1ALSA-2026:3336
AlmaLinux:8podman-docker4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-docker6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-gvproxy4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8podman-plugins4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-plugins6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-remote4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-remote6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-tests4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-tests6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:4672
AlmaLinux:8python3-podman4.9.0-3.module_el8.10.0+4016+efd18bf8ALSA-2026:4672
AlmaLinux:8runc4:1.2.9-4.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9runc4:1.4.0-2.el9_7ALSA-2026:3291
AlmaLinux:10skopeo2:1.20.0-3.el10_1ALSA-2026:3343
AlmaLinux:8skopeo2:1.14.5-7.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9skopeo2:1.20.0-3.el9_7ALSA-2026:3340
AlmaLinux:10skopeo-tests2:1.20.0-3.el10_1ALSA-2026:3343
AlmaLinux:8skopeo-tests2:1.14.5-7.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9skopeo-tests2:1.20.0-3.el9_7ALSA-2026:3340
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4023+db236c53ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3926+f12484f5ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8toolbox0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8toolbox-tests0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8udica0.2.6-21.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:10yggdrasil0.4.8-3.el10_1ALSA-2026:5146
AlmaLinux:10yggdrasil-devel0.4.8-3.el10_1ALSA-2026:5146
Alpine:v3.22go1.24.12-r0, 1.24.13-r0ALPINE-CVE-2025-68121
Alpine:v3.23go1.25.6-r0, 1.25.7-r0ALPINE-CVE-2025-68121
Alpine:v3.24go1.25.6-r0, 1.25.7-r0ALPINE-CVE-2025-68121
Alpine:v3.24rclone1.73.5-r0ALPINE-CVE-2025-68121
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-68121
Debian:13golang-1.24no fix listedDEBIAN-CVE-2025-68121
Gostdlib1.24.13, 1.25.7, 1.26.0-rc.3GO-2026-4337
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:10buildah2:1.41.8-2.el10_1RLSA-2026:3297
Rocky Linux:9buildah2:1.41.8-2.el9_7RLSA-2026:3298
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:9containernetworking-plugins1:1.9.0-2.el9RLSA-2026:18913
Rocky Linux:9containernetworking-plugins1:1.7.1-3.el9_7RLSA-2026:3341
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2026:4672

Affected products (as reported)

VendorProductVersions
Go standard library crypto/tls 0 – before 1.24.131.25.0-0 – before 1.25.71.26.0-rc.1 – before 1.26.0-rc.3

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References