CVE-2025-54799 Lego does not enforce HTTPS
Attackers can intercept ACME protocol traffic if HTTP URLs are used, exposing sensitive account and request identifiers due to missing HTTPS enforcement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-54799?
CVE-2025-54799 is a low-severity vulnerability in go-acme lego, published on 7 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.
Weakness: CWE-319
Which versions are affected by CVE-2025-54799?
7 open source packages ship an affected version, including github.com/go-acme/lego/v4, github.com/go-acme/lego and github.com/go-acme/lego/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-acme/lego/v4 Go | All versions | 4.25.2 |
github.com/go-acme/lego/v4 Go | All versions | 4.25.2 |
github.com/go-acme/lego/v4 Go | All versions | 4.25.2 |
github.com/go-acme/lego Go | All versions to 4.25.1 | None |
github.com/go-acme/lego Go | All versions to 4.25.1 | None |
github.com/go-acme/lego/v3 Go | All versions to 4.25.1 | None |
1 more packages
github.com/go-acme/lego/v3 Go | All versions to 4.25.1 | None |
How do I fix CVE-2025-54799?
Upgrade github.com/go-acme/lego/v4 to 4.25.2 or later.
Is CVE-2025-54799 being exploited?
There is no known exploitation of CVE-2025-54799 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-HZ83743, DEBIAN-CVE-2025-54799, GHSA-q82r-2j7m-9rv4, GO-2025-3847, MINI-2mv5-3crg-jv2p, MINI-fg45-x2pv-34gp and 1 more.