{"id":"GO-2026-5856","aliases":["BIT-golang-2026-42505","CVE-2026-42505"],"title":"Invoking Encrypted Client Hello privacy leak in crypto/tls","titleSource":"OSV","descriptionSource":"OSV","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.","severity":"unknown","score":null,"published":"2026-07-07T21:34:47.000Z","modified":"2026-11-14T13:12:14.649Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"stdlib","sources":[{"name":"OSV · GO-2026-5856","url":"https://osv.dev/vulnerability/GO-2026-5856"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.25.12"},{"introduced":"1.26.0-0"},{"fixed":"1.26.5"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0-rc.2"}],"type":"SEMVER"}],"versions":[],"fixed":["1.25.12","1.26.5","1.27.0-rc.2"]}],"sourceAffected":[],"references":["https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"],"sources":[{"name":"OSV","id":"GO-2026-5856","modified":"2026-11-14T13:12:14.649572174Z","url":"https://osv.dev/vulnerability/GO-2026-5856"}],"assessments":[],"products":[],"remediation":[],"observedAt":"2026-11-14T15:22:24.554Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:45:30.863Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T15:40:47.383Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T15:35:33.399Z","attemptedAt":"2026-11-14T15:35:33.399Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T15:35:33.581Z","attemptedAt":"2026-11-14T15:35:33.581Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T15:35:33.326Z","attemptedAt":"2026-11-14T15:35:33.326Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-42505","url":"https://www.first.org/epss/","probability":0.00382,"percentile":0.32771,"date":"2026-11-14","checkedAt":"2026-11-14T15:35:33.326Z"},{"source":"GitHub Advisory Database","id":"GHSA-ff52-ph69-cf7x","url":"https://github.com/advisories/GHSA-ff52-ph69-cf7x","modified":"2026-07-08T21:30:27Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-14T15:35:33.399Z"},{"source":"ENISA EUVD","id":"EUVD-2026-42317","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42317","modified":"Jul 8, 2026, 7:38:17 PM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-14T15:35:33.581Z"}],"aiSummary":null}