CVE-2025-58189
BaseFortify
Publication date: 2025-10-29
Last updated on: 2025-11-04
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | From 1.25.0 (inc) to 1.25.2 (inc) |
| golang | go | 1.25.0 |
| golang | go | 1.25.2 |
| golang | go | 1.24.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when the connection handshake fails during ALPN (Application-Layer Protocol Negotiation). The error message generated includes information controlled by the attacker (the ALPN protocols sent by the client) and this information is not properly escaped, potentially leading to security issues.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to inject malicious content into error messages due to unescaped attacker-controlled input. This could lead to information disclosure or other security risks depending on how the error messages are handled or displayed.