CVE-2025-68121
CriticalCVSS 10.0Summary
In Go's crypto/tls, session resumption may incorrectly succeed if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial and resumed handshake. This can occur when using Config.Clone and mutating the returned Config, or Config.GetConfigForClient. It may cause a client or server to resume a session with a peer it would not have resumed with during the initial handshake.
Risk Assessment
This can lead to TLS sessions being established with untrusted peers contrary to the intended configuration, weakening certificate trust enforcement. The risk applies to Go applications that dynamically modify TLS configuration.
Recommendation
Update Go to a version containing the fix and avoid mutating TLS configuration between handshakes. Review code using Config.Clone and GetConfigForClient for CA field mutations.
Other vulnerabilities in Go crypto/tls
Original NVD description (English source)
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS