{"id":"CVE-2025-61730","title":"crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVE-2025-61730)","summary":"A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted E…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","cwe":"CWE-325","vendor":"Red Hat","product":"Red Hat Ceph Storage 6","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","compliance_operator","confidential_compute_attestation","cryostat 4","custom_metric_autoscaler_operator_for_red_hat_openshift","deployment_validation_operator","external_secrets_operator_for_red_hat_openshift","externaldns_operator","fence_agents_remediation_operator","file_integrity_operator","gatekeeper 3","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","machine_deletion_remediation_operator","migration_toolkit_for_applications 8","migration_toolkit_for_containers","mirror_registry_for_red_hat_openshift","mirror_registry_for_red_hat_openshift 2","multiarch_tuning_operator","multicluster_engine_for_kubernetes","multicluster_global_hub","network_observability_operator","node_healthcheck_operator","node_maintenance_operator","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_lightspeed","openshift_serverless","openshift_service_mesh 2","openshift_service_mesh 3","openshift_source_to_image_s2i","power_monitoring_for_red_hat_openshift","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","ceph_storage 5","ceph_storage 6"],"patched":["cert_manager_support_for_red_hat_openshift_release 1.18","hardened_images"],"published":"2026-01-28","updated":"2026-10-14","sourceUpdated":"2026-10-14T03:12:27+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61730.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61730.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-61730"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434430"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61730"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730"},{"url":"https://access.redhat.com/errata/RHSA-2026:82354"},{"url":"https://access.redhat.com/errata/RHSA-2026:82372"},{"url":"https://access.redhat.com/errata/RHSA-2026:82347"},{"url":"https://access.redhat.com/errata/RHSA-2026:7385"},{"url":"https://access.redhat.com/errata/RHSA-2026:7291"},{"url":"https://go.dev/cl/724120"},{"url":"https://go.dev/issue/76443"},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00324,"epssPercentile":0.25261,"aliases":["GO-2026-4340","BIT-golang-2025-61730"],"ecosystem":"go","ingestedAt":"2026-08-07T19:14:19.194Z","slug":"CVE-2025-61730","body":"## Overview\n\nA TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.\n\n## Vendor advisories\n\n- **RHSA-2026:82354** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82354)\n- **RHSA-2026:82372** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82372)\n- **RHSA-2026:82347** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82347)\n- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)\n- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, … · no fix planned: Red Hat Enterprise Linux 9, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator, … · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61730.json)\n\n**crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls** — rated Moderate by Red Hat. Released 2025-01-01, updated 2026-10-14.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Machine Deletion Remediation Operator\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- mirror registry for Red Hat OpenShift\n- mirror registry for Red Hat OpenShift 2\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- Node Maintenance Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- OpenShift Source-to-Image (S2I)\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n\nFixed:\n\n- Cert Manager support for Red Hat OpenShift release 1.18\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 9\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Machine Deletion Remediation Operator\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- mirror registry for Red Hat OpenShift\n- mirror registry for Red Hat OpenShift 2\n- Multiarch Tuning Operator\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- Node Maintenance Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- OpenShift Source-to-Image (S2I)\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat Ceph Storage 5\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82354\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82372\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82347\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2025-61730)\n\nAffected packages:\n\n- `stdlib >= 1.25.0, < 1.25.6`\n\nPatched in:\n\n- `stdlib 1.25.6`\n\nSource: https://osv.dev/vulnerability/GO-2026-4340","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201419,"id":"CVE-2025-61730","ts":1789399443339,"field":"cvss","old":null,"new":"5.3"},{"seq":201418,"id":"CVE-2025-61730","ts":1789399443339,"field":"severity","old":"none","new":"medium"},{"seq":200154,"id":"CVE-2025-61730","ts":1789396885717,"field":"cvss","old":"5.3","new":null},{"seq":200153,"id":"CVE-2025-61730","ts":1789396885717,"field":"severity","old":"medium","new":"none"},{"seq":198076,"id":"CVE-2025-61730","ts":1789387941716,"field":"cvss","old":null,"new":"5.3"},{"seq":198075,"id":"CVE-2025-61730","ts":1789387941716,"field":"severity","old":"none","new":"medium"},{"seq":195873,"id":"CVE-2025-61730","ts":1789383271925,"field":"cvss","old":"5.3","new":null},{"seq":195872,"id":"CVE-2025-61730","ts":1789383271925,"field":"severity","old":"medium","new":"none"},{"seq":194801,"id":"CVE-2025-61730","ts":1789380264682,"field":"cvss","old":null,"new":"5.3"},{"seq":194800,"id":"CVE-2025-61730","ts":1789380264682,"field":"severity","old":"none","new":"medium"},{"seq":193589,"id":"CVE-2025-61730","ts":1789378137901,"field":"cvss","old":"5.3","new":null},{"seq":193588,"id":"CVE-2025-61730","ts":1789378137901,"field":"severity","old":"medium","new":"none"},{"seq":192375,"id":"CVE-2025-61730","ts":1789376183290,"field":"cvss","old":null,"new":"5.3"},{"seq":192374,"id":"CVE-2025-61730","ts":1789376183290,"field":"severity","old":"none","new":"medium"},{"seq":191163,"id":"CVE-2025-61730","ts":1789373003401,"field":"cvss","old":"5.3","new":null},{"seq":191162,"id":"CVE-2025-61730","ts":1789373003401,"field":"severity","old":"medium","new":"none"},{"seq":189947,"id":"CVE-2025-61730","ts":1789369083098,"field":"cvss","old":null,"new":"5.3"},{"seq":189946,"id":"CVE-2025-61730","ts":1789369083098,"field":"severity","old":"none","new":"medium"},{"seq":188735,"id":"CVE-2025-61730","ts":1789367962175,"field":"cvss","old":"5.3","new":null},{"seq":188734,"id":"CVE-2025-61730","ts":1789367962175,"field":"severity","old":"medium","new":"none"},{"seq":187517,"id":"CVE-2025-61730","ts":1789364932170,"field":"cvss","old":null,"new":"5.3"},{"seq":187516,"id":"CVE-2025-61730","ts":1789364932170,"field":"severity","old":"none","new":"medium"},{"seq":186305,"id":"CVE-2025-61730","ts":1789362892948,"field":"cvss","old":"5.3","new":null},{"seq":186304,"id":"CVE-2025-61730","ts":1789362892948,"field":"severity","old":"medium","new":"none"},{"seq":185091,"id":"CVE-2025-61730","ts":1789360918394,"field":"cvss","old":null,"new":"5.3"},{"seq":185090,"id":"CVE-2025-61730","ts":1789360918394,"field":"severity","old":"none","new":"medium"},{"seq":183878,"id":"CVE-2025-61730","ts":1789357817488,"field":"cvss","old":"5.3","new":null},{"seq":183877,"id":"CVE-2025-61730","ts":1789357817488,"field":"severity","old":"medium","new":"none"},{"seq":182130,"id":"CVE-2025-61730","ts":1789354048105,"field":"cvss","old":null,"new":"5.3"},{"seq":182129,"id":"CVE-2025-61730","ts":1789354048105,"field":"severity","old":"none","new":"medium"},{"seq":180923,"id":"CVE-2025-61730","ts":1789352855570,"field":"cvss","old":"5.3","new":null},{"seq":180922,"id":"CVE-2025-61730","ts":1789352855570,"field":"severity","old":"medium","new":"none"},{"seq":179716,"id":"CVE-2025-61730","ts":1789349938618,"field":"cvss","old":null,"new":"5.3"},{"seq":179715,"id":"CVE-2025-61730","ts":1789349938618,"field":"severity","old":"none","new":"medium"},{"seq":178509,"id":"CVE-2025-61730","ts":1789347692021,"field":"cvss","old":"5.3","new":null},{"seq":178508,"id":"CVE-2025-61730","ts":1789347692021,"field":"severity","old":"medium","new":"none"},{"seq":177302,"id":"CVE-2025-61730","ts":1789346122943,"field":"cvss","old":null,"new":"5.3"},{"seq":177301,"id":"CVE-2025-61730","ts":1789346122943,"field":"severity","old":"none","new":"medium"},{"seq":176095,"id":"CVE-2025-61730","ts":1789342634858,"field":"cvss","old":"5.3","new":null},{"seq":176094,"id":"CVE-2025-61730","ts":1789342634858,"field":"severity","old":"medium","new":"none"},{"seq":175881,"id":"CVE-2025-61730","ts":1789342225159,"field":"cvss","old":null,"new":"5.3"},{"seq":175880,"id":"CVE-2025-61730","ts":1789342225159,"field":"severity","old":"none","new":"medium"},{"seq":175419,"id":"CVE-2025-61730","ts":1789338259999,"field":"cvss","old":"5.3","new":null},{"seq":175418,"id":"CVE-2025-61730","ts":1789338259999,"field":"severity","old":"medium","new":"none"},{"seq":174214,"id":"CVE-2025-61730","ts":1789334547728,"field":"cvss","old":null,"new":"5.3"},{"seq":174213,"id":"CVE-2025-61730","ts":1789334547728,"field":"severity","old":"none","new":"medium"},{"seq":170637,"id":"CVE-2025-61730","ts":1789328261932,"field":"cvss","old":"5.3","new":null},{"seq":170636,"id":"CVE-2025-61730","ts":1789328261932,"field":"severity","old":"medium","new":"none"},{"seq":169432,"id":"CVE-2025-61730","ts":1789326840061,"field":"cvss","old":null,"new":"5.3"},{"seq":169431,"id":"CVE-2025-61730","ts":1789326840061,"field":"severity","old":"none","new":"medium"}]}