{"id":"CVE-2025-61730","title":"crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVE-2025-61730)","summary":"A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted E…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","cwe":"CWE-325","vendor":"Red Hat","product":"Red Hat Ceph Storage 6","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","compliance_operator","confidential_compute_attestation","cryostat 4","custom_metric_autoscaler_operator_for_red_hat_openshift","deployment_validation_operator","external_secrets_operator_for_red_hat_openshift","externaldns_operator","fence_agents_remediation_operator","file_integrity_operator","gatekeeper 3","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","machine_deletion_remediation_operator","migration_toolkit_for_applications 8","migration_toolkit_for_containers","mirror_registry_for_red_hat_openshift","mirror_registry_for_red_hat_openshift 2","multiarch_tuning_operator","multicluster_engine_for_kubernetes","multicluster_global_hub","network_observability_operator","node_healthcheck_operator","node_maintenance_operator","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_lightspeed","openshift_serverless","openshift_service_mesh 2","openshift_service_mesh 3","openshift_source_to_image_s2i","power_monitoring_for_red_hat_openshift","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","ceph_storage 5"],"patched":["hardened_images"],"published":"2026-01-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:02:01+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61730.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61730.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-61730"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434430"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61730"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730"},{"url":"https://access.redhat.com/errata/RHSA-2026:7385"},{"url":"https://access.redhat.com/errata/RHSA-2026:7291"},{"url":"https://go.dev/cl/724120"},{"url":"https://go.dev/issue/76443"},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00286,"epssPercentile":0.2138,"aliases":["GO-2026-4340","BIT-golang-2025-61730"],"ecosystem":"go","ingestedAt":"2026-08-07T19:14:19.194Z","slug":"CVE-2025-61730","body":"## Overview\n\nA TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.\n\n## Vendor advisories\n\n- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)\n- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, … · no fix planned: Red Hat Enterprise Linux 9, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61730.json)\n\n**crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls** — rated Moderate by Red Hat. Released 2025-01-01, updated 2026-09-10.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Machine Deletion Remediation Operator\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- mirror registry for Red Hat OpenShift\n- mirror registry for Red Hat OpenShift 2\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- Node Maintenance Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- OpenShift Source-to-Image (S2I)\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat Ceph Storage 5\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 9\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Machine Deletion Remediation Operator\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- mirror registry for Red Hat OpenShift\n- mirror registry for Red Hat OpenShift 2\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- Node Maintenance Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- OpenShift Source-to-Image (S2I)\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7385\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7291\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2025-61730)\n\nAffected packages:\n\n- `stdlib >= 1.25.0, < 1.25.6`\n\nPatched in:\n\n- `stdlib 1.25.6`\n\nSource: https://osv.dev/vulnerability/GO-2026-4340","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201419,"id":"CVE-2025-61730","ts":1789399443339,"field":"cvss","old":null,"new":"5.3"},{"seq":201418,"id":"CVE-2025-61730","ts":1789399443339,"field":"severity","old":"none","new":"medium"},{"seq":200154,"id":"CVE-2025-61730","ts":1789396885717,"field":"cvss","old":"5.3","new":null},{"seq":200153,"id":"CVE-2025-61730","ts":1789396885717,"field":"severity","old":"medium","new":"none"},{"seq":198076,"id":"CVE-2025-61730","ts":1789387941716,"field":"cvss","old":null,"new":"5.3"},{"seq":198075,"id":"CVE-2025-61730","ts":1789387941716,"field":"severity","old":"none","new":"medium"},{"seq":195873,"id":"CVE-2025-61730","ts":1789383271925,"field":"cvss","old":"5.3","new":null},{"seq":195872,"id":"CVE-2025-61730","ts":1789383271925,"field":"severity","old":"medium","new":"none"},{"seq":194801,"id":"CVE-2025-61730","ts":1789380264682,"field":"cvss","old":null,"new":"5.3"},{"seq":194800,"id":"CVE-2025-61730","ts":1789380264682,"field":"severity","old":"none","new":"medium"},{"seq":193589,"id":"CVE-2025-61730","ts":1789378137901,"field":"cvss","old":"5.3","new":null},{"seq":193588,"id":"CVE-2025-61730","ts":1789378137901,"field":"severity","old":"medium","new":"none"},{"seq":192375,"id":"CVE-2025-61730","ts":1789376183290,"field":"cvss","old":null,"new":"5.3"},{"seq":192374,"id":"CVE-2025-61730","ts":1789376183290,"field":"severity","old":"none","new":"medium"},{"seq":191163,"id":"CVE-2025-61730","ts":1789373003401,"field":"cvss","old":"5.3","new":null},{"seq":191162,"id":"CVE-2025-61730","ts":1789373003401,"field":"severity","old":"medium","new":"none"},{"seq":189947,"id":"CVE-2025-61730","ts":1789369083098,"field":"cvss","old":null,"new":"5.3"},{"seq":189946,"id":"CVE-2025-61730","ts":1789369083098,"field":"severity","old":"none","new":"medium"},{"seq":188735,"id":"CVE-2025-61730","ts":1789367962175,"field":"cvss","old":"5.3","new":null},{"seq":188734,"id":"CVE-2025-61730","ts":1789367962175,"field":"severity","old":"medium","new":"none"},{"seq":187517,"id":"CVE-2025-61730","ts":1789364932170,"field":"cvss","old":null,"new":"5.3"},{"seq":187516,"id":"CVE-2025-61730","ts":1789364932170,"field":"severity","old":"none","new":"medium"},{"seq":186305,"id":"CVE-2025-61730","ts":1789362892948,"field":"cvss","old":"5.3","new":null},{"seq":186304,"id":"CVE-2025-61730","ts":1789362892948,"field":"severity","old":"medium","new":"none"},{"seq":185091,"id":"CVE-2025-61730","ts":1789360918394,"field":"cvss","old":null,"new":"5.3"},{"seq":185090,"id":"CVE-2025-61730","ts":1789360918394,"field":"severity","old":"none","new":"medium"},{"seq":183878,"id":"CVE-2025-61730","ts":1789357817488,"field":"cvss","old":"5.3","new":null},{"seq":183877,"id":"CVE-2025-61730","ts":1789357817488,"field":"severity","old":"medium","new":"none"},{"seq":182130,"id":"CVE-2025-61730","ts":1789354048105,"field":"cvss","old":null,"new":"5.3"},{"seq":182129,"id":"CVE-2025-61730","ts":1789354048105,"field":"severity","old":"none","new":"medium"},{"seq":180923,"id":"CVE-2025-61730","ts":1789352855570,"field":"cvss","old":"5.3","new":null},{"seq":180922,"id":"CVE-2025-61730","ts":1789352855570,"field":"severity","old":"medium","new":"none"},{"seq":179716,"id":"CVE-2025-61730","ts":1789349938618,"field":"cvss","old":null,"new":"5.3"},{"seq":179715,"id":"CVE-2025-61730","ts":1789349938618,"field":"severity","old":"none","new":"medium"},{"seq":178509,"id":"CVE-2025-61730","ts":1789347692021,"field":"cvss","old":"5.3","new":null},{"seq":178508,"id":"CVE-2025-61730","ts":1789347692021,"field":"severity","old":"medium","new":"none"},{"seq":177302,"id":"CVE-2025-61730","ts":1789346122943,"field":"cvss","old":null,"new":"5.3"},{"seq":177301,"id":"CVE-2025-61730","ts":1789346122943,"field":"severity","old":"none","new":"medium"},{"seq":176095,"id":"CVE-2025-61730","ts":1789342634858,"field":"cvss","old":"5.3","new":null},{"seq":176094,"id":"CVE-2025-61730","ts":1789342634858,"field":"severity","old":"medium","new":"none"},{"seq":175881,"id":"CVE-2025-61730","ts":1789342225159,"field":"cvss","old":null,"new":"5.3"},{"seq":175880,"id":"CVE-2025-61730","ts":1789342225159,"field":"severity","old":"none","new":"medium"},{"seq":175419,"id":"CVE-2025-61730","ts":1789338259999,"field":"cvss","old":"5.3","new":null},{"seq":175418,"id":"CVE-2025-61730","ts":1789338259999,"field":"severity","old":"medium","new":"none"},{"seq":174214,"id":"CVE-2025-61730","ts":1789334547728,"field":"cvss","old":null,"new":"5.3"},{"seq":174213,"id":"CVE-2025-61730","ts":1789334547728,"field":"severity","old":"none","new":"medium"},{"seq":170637,"id":"CVE-2025-61730","ts":1789328261932,"field":"cvss","old":"5.3","new":null},{"seq":170636,"id":"CVE-2025-61730","ts":1789328261932,"field":"severity","old":"medium","new":"none"},{"seq":169432,"id":"CVE-2025-61730","ts":1789326840061,"field":"cvss","old":null,"new":"5.3"},{"seq":169431,"id":"CVE-2025-61730","ts":1789326840061,"field":"severity","old":"none","new":"medium"}]}