CVE-2025-68121 Unexpected session resumption in crypto/tls
Attackers can bypass TLS certificate validation during session resumption if the application mutates TLS configuration between handshakes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68121?
CVE-2025-68121 is a critical vulnerability in Golang Go, published on 5 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
Weakness: CWE-295
Which versions are affected by CVE-2025-68121?
2 open source packages ship an affected version, including golang and stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.24.13, 1.25.7 |
stdlib Go | All versions | 1.24.13, 1.25.7, 1.26.0-rc.3 |
Linux distribution packages (21)
delve AlmaLinux:9 | All versions | 1.25.2-2.el9_7 |
delve Red Hat:enterprise_linux:9::appstream | All versions | 0:1.25.2-2.el9_7 |
delve-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.25.2-2.el9_7 |
delve-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.25.2-2.el9_7 |
osbuild-composer Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
osbuild-composer-core Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
osbuild-composer-core-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
osbuild-composer-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
osbuild-composer-tests-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
osbuild-composer-worker Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
osbuild-composer-worker-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:134.1-6.el10_0 |
skopeo Red Hat:openshift:4.18::el9 | All versions | 2:1.16.1-5.rhaos4.18.el9 |
skopeo-debuginfo Red Hat:openshift:4.18::el9 | All versions | 2:1.16.1-5.rhaos4.18.el9 |
skopeo-debugsource Red Hat:openshift:4.18::el9 | All versions | 2:1.16.1-5.rhaos4.18.el9 |
skopeo-tests Red Hat:openshift:4.18::el9 | All versions | 2:1.16.1-5.rhaos4.18.el9 |
delve Rocky Linux:9 | All versions | 0:1.25.2-2.el9_7 |
cmctl openSUSE:Tumbleweed | All versions | 2.4.1-1.1 |
golang-github-lusitaniae-apache_exporter openSUSE:Tumbleweed | All versions | 1.1.1-1.1 |
kyverno openSUSE:Tumbleweed | All versions | 1.17.1-1.1 |
rclone openSUSE:Tumbleweed | All versions | 1.73.1-1.1 |
regclient openSUSE:Tumbleweed | All versions | 0.11.2-1.1 |
Products include Golang Go.
How do I fix CVE-2025-68121?
Upgrade golang to a fixed version for your release line: 1.24.13 or 1.25.7.
Is CVE-2025-68121 being exploited?
There is no known exploitation of CVE-2025-68121 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as ALSA-2026:3842, AZL-76653, AZL-76662, AZL-76665, AZL-98847, BELL-CVE-2025-68121 and 486 more.