crypto/tls
- Software type
- Software library
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/21/2026, crypto/tls recorded 2 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of crypto/tls and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-97031Reject malformed ECH outer extension references in crypto/tlsCVE-2026-56862Limit handshake messages we are willing to accept post-handshake in crypto/tlsCVE-2026-42505Invoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2025-68121Unexpected session resumption in crypto/tls| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-97031Reject malformed ECH outer extension references in crypto/tls | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-56862Limit handshake messages we are willing to accept post-handshake in crypto/tls | Exploitation statusNot exploited | FixYes | Published08/13/2026 | SeverityHigh |
|---|
CVE-2026-42505Invoking Encrypted Client Hello privacy leak in crypto/tls | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls | Exploitation statusNot exploited | FixYes | Published04/08/2026 | SeverityHigh |
|---|
CVE-2025-68121Unexpected session resumption in crypto/tls | Exploitation statusNot exploited | FixYes | Published02/05/2026 | SeverityCritical |
|---|
CVE-2025-61730Handshake messages may be processed at the incorrect encryption level in crypto/tls | Exploitation statusNot exploited | FixYes | Published01/28/2026 | SeverityMedium |
|---|
CVE-2025-58189ALPN negotiation error contains attacker controlled information in crypto/tls | Exploitation statusNot exploited | FixYes | Published10/29/2025 | SeverityMedium |
|---|
CVE-2023-45287Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel | Exploitation statusNot confirmed | FixYes | Published12/05/2023 | SeverityUnknown |
|---|
CVE-2023-39322Memory exhaustion in QUIC connection handling in crypto/tls | Exploitation statusNot exploited | FixYes | Published09/08/2023 | SeverityUnknown |
|---|
CVE-2023-39321Panic when processing post-handshake message on QUIC connections in crypto/tls | Exploitation statusNot exploited | FixYes | Published09/08/2023 | SeverityUnknown |
|---|
13 Results | Page 1 of 2