Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
go1.27 TLS session resumption can bypass certificate checks
published 13 days ago
Summary
The Go 1.27 TLS library may allow a connection to resume a session even if the trusted certificate lists (ClientCAs or RootCAs) are changed in between. This means an unauthorized party could be accepted when it should be rejected. Keep the certificate authority settings unchanged after the first handshake or update to a newer Go release that corrects the behavior.
What to do
- Update cleanstart go1.27 to version 1.25.5-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | go1.27 |
< 1.25.5-r1 Fix: upgrade to 1.25.5-r1
|
Original advisory text
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Security vulnerability affects the go1.27 package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-YX19241 · OSV
Track software like this
Free during beta