CVE-2025-58189

—

CVSS 3.1

5.3 medium

EPSS

<1%p37

Published

Oct 29, 2025 (Oct 29, 2025)

Modified

Jun 17, 2026

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

Vendors: golang
Products: go
Weakness: CWE-532
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.