BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-11-04

Assigner: Go Project

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-11-04

Generated

2026-07-06

AI Q&A

2025-10-30

EPSS Evaluated

2026-07-05

NVD

CVE-2025-58189

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	From 1.25.0 (inc) to 1.25.2 (inc)
golang	go	1.25.0
golang	go	1.25.2
golang	go	1.24.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs when the connection handshake fails during ALPN (Application-Layer Protocol Negotiation). The error message generated includes information controlled by the attacker (the ALPN protocols sent by the client) and this information is not properly escaped, potentially leading to security issues.

Impact Analysis

The vulnerability can allow an attacker to inject malicious content into error messages due to unescaped attacker-controlled input. This could lead to information disclosure or other security risks depending on how the error messages are handled or displayed.

Hi! I’m here to help you understand CVE-2025-58189. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70