Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Firefox Encrypted Client Hello Privacy Leak

CVE-2026-42505 · published 3 months ago
Summary

A security flaw in Firefox's encrypted connection feature could allow an attacker to identify users who have previously connected to a website. This is a concern for users who value their online anonymity. To protect users, Firefox developers are working on a fix, and users should keep their browser up to date to ensure they have the latest security patches.

What to do
  • Update bellsoft go to version 1.25.12-r0.
  • Update bellsoft go to version 1.26.5-r0.
  • Update stdlib to version 1.27.0-rc.2.
  • Update debian golang-1.25 to version 1.25.12-1.
  • Update debian golang-1.26 to version 1.26.5-1.
  • Update debian golang-1.27 to version 1.27~rc2-1.
  • Update go standard library crypto/tls to version 1.25.12 or later.
Affected software
Ecosystem VendorProductAffected versions
– go standard library crypto/tls < 1.25.12
Debian:11 debian golang-1.15 All versions
Debian:12 debian golang-1.19 All versions
Debian:13 debian golang-1.24 All versions
Debian:14 debian golang-1.25 < 1.25.12-1
Fix: upgrade to 1.25.12-1
Debian:14 debian golang-1.26 < 1.26.5-1
Fix: upgrade to 1.26.5-1
Debian:14 debian golang-1.27 < 1.27~rc2-1
Fix: upgrade to 1.27~rc2-1
BellSoft Hardened Containers:25 bellsoft go >= 1.24.3-r0, < 1.25.12-r0
Fix: upgrade to 1.25.12-r0
BellSoft Hardened Containers:stream bellsoft go >= 1.20.5-r2, < 1.26.5-r0
Fix: upgrade to 1.26.5-r0
Alpaquita:23 bellsoft go >= 1.19.7-r0, < 1.25.12-r0
Fix: upgrade to 1.25.12-r0
Alpaquita:25 bellsoft go >= 1.24.3-r0, < 1.25.12-r0
Fix: upgrade to 1.25.12-r0
Alpaquita:stream bellsoft go >= 1.20.5-r2, < 1.26.5-r0
Fix: upgrade to 1.26.5-r0
Go – stdlib >= 1.27.0-0, < 1.27.0-rc.2
Fix: upgrade to 1.27.0-rc.2
BellSoft Hardened Containers:23 bellsoft go >= 1.19.7-r0, < 1.25.12-r0
Fix: upgrade to 1.25.12-r0
– golang go >= 1.23.0, < 1.25.12
>= 1.26.0, < 1.26.5
1.27
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Ubuntu:14.04:LTS canonical golang-1.10 All versions
Ubuntu:16.04:LTS canonical golang-1.6 All versions
Ubuntu:Pro:16.04:LTS canonical golang-1.13 All versions
Ubuntu:Pro:16.04:LTS canonical golang-1.18 All versions
Ubuntu:Pro:18.04:LTS canonical golang-1.16 All versions
Ubuntu:18.04:LTS canonical golang-1.8 All versions
Ubuntu:18.04:LTS canonical golang-1.9 All versions
Ubuntu:20.04:LTS canonical golang-1.14 All versions
Ubuntu:20.04:LTS canonical golang-1.20 All versions
Ubuntu:20.04:LTS canonical golang-1.21 All versions
Ubuntu:20.04:LTS canonical golang-1.22 All versions
Ubuntu:22.04:LTS canonical golang-1.17 All versions
Ubuntu:22.04:LTS canonical golang-1.23 All versions
Ubuntu:22.04:LTS canonical golang-1.24 All versions
Ubuntu:25.10 canonical golang-1.25 All versions
Original advisory text
Invoking Encrypted Client Hello privacy leak in crypto/tls
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published8 Jul 2026
Updated4 Nov 2026
First seen8 Jul 2026
Sources
DEBIAN-CVE-2026-42505 · OSV
CVE-2026-42505 · NVD
CVE-2026-42505 · MITRE
GO-2026-5856 · OSV
BELL-CVE-2026-42505 · OSV
CVE-2026-42505 · OSV
UBUNTU-CVE-2026-42505 · OSV
Track software like this
Free during beta