CVE-2025-61730Medium· 5.3▾ SunlitA TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted E…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
5.3 → —
medium → none
— → 5.3
none → medium
5.3 → —
medium → none
— → 5.3
none → medium
5.3 → —
medium → none
— → 5.3
none → medium
0.3% → 0.3%
Last analysed / modified upstream
A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls — rated Moderate by Red Hat. Released 2025-01-01, updated 2026-10-14.
Affected:
Fixed:
No fix planned:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.
If the approval policy is set to Automatic, then the Operator will be upgraded automatically when there is a
new version of the Operator. No further action is required to upgrade. This is the default setting.
If you changed the approval policy to Manual, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82354
Before applying this update, make sure all previously released errata relevant to your system have been applied.
The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.
If the approval policy is set to Automatic, then the Operator will be upgraded automatically when there is a
new version of the Operator. No further action is required to upgrade. This is the default setting.
If you changed the approval policy to Manual, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82372
Before applying this update, make sure all previously released errata relevant to your system have been applied.
The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.
If the approval policy is set to Automatic, then the Operator will be upgraded automatically when there is a
new version of the Operator. No further action is required to upgrade. This is the default setting.
If you changed the approval policy to Manual, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:82347
Workarounds / mitigations:
Affected packages:
stdlib >= 1.25.0, < 1.25.6Patched in:
stdlib 1.25.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-69418Medium· 4.0openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)
CVE-2026-59650High· 7.4In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)