CVE-2025-54799
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-07

Last updated on: 2025-08-07

Assigner: GitHub, Inc.

Description
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-07
Last Modified
2025-08-07
Generated
2026-05-07
AI Q&A
2025-08-07
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
go-acme lego 4.25.1
go-acme lego 4.25.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Let's Encrypt client and ACME library written in Go (Lego) versions 4.25.1 and below. The library does not enforce the use of HTTPS when communicating with Certificate Authorities (CAs) as an ACME client. Instead, it allows communication over unencrypted HTTP if users input HTTP URLs or if CAs misconfigure endpoints. This breaks the ACME protocol requirement for HTTPS communication, potentially exposing sensitive request and response details such as account and request identifiers to network attackers.


How can this vulnerability impact me? :

The vulnerability can compromise your privacy and security by exposing sensitive information exchanged between the ACME client and the CA over the network. Attackers could intercept or observe account details and request identifiers, which could lead to unauthorized access or misuse of certificate issuance processes.


What immediate steps should I take to mitigate this vulnerability?

Upgrade the Let's Encrypt client and ACME library (Lego) to version 4.25.2 or later, as this version fixes the issue by enforcing HTTPS when communicating with CAs. Avoid using HTTP URLs for CA endpoints to prevent unencrypted communication.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart