CVE-2026-42505Medium· 5.3▾ SunlitHandshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
— → 5.3
none → medium
5.3 → —
medium → none
— → 5.3
none → medium
Last analysed / modified upstream
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
go >= 1.23.0, < 1.25.12go >= 1.26.0, < 1.26.5go = 1.27Upgrade past the affected range:
go 1.26.5Affected packages:
stdlib >= 1.27.0-0, < 1.27.0-rc.2Patched in:
stdlib 1.27.0-rc.2Source: https://osv.dev/vulnerability/GO-2026-5856
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39822High· 7.8On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /
CVE-2026-39821Critical· 9.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
CVE-2026-27137High· 7.5When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…
CVE-2026-33810High· 8.2When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint
CVE-2026-32288Medium· 5.5tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
CVE-2026-39832Critical· 9.1When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request