CVE-2025-58189: Golang ALPN Negotiation Error Exposes Attacker Controlled Information
Summary
CVE-2025-58189: ALPN negotiation error contains attacker controlled information in crypto/tls. Affects golang across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-58189 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language designed for simplicity and efficiency. It is widely used for building scalable web applications, cloud services, and other software solutions. The language's concurrency features and robust standard library make it a popular choice among developers. However, like any software, it is not immune to vulnerabilities, such as the one identified in this report.
Vulnerability Detail
The vulnerability arises during the ALPN (Application-Layer Protocol Negotiation) handshake process in the crypto/tls package of Golang. When the handshake fails, the error message returned contains information controlled by the attacker, specifically the ALPN protocols sent by the client. This exposure can lead to information disclosure, allowing attackers to glean insights into the client's capabilities and potentially exploit this information in further attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8 -
>= 1.25.0, < 1.25.21.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional error handling in your application to sanitize the error messages returned during the ALPN negotiation process, ensuring that no sensitive information is exposed to potential attackers.
Conclusion
In summary, CVE-2025-58189 is a vulnerability in the Golang crypto/tls package that exposes attacker-controlled information during ALPN negotiation failures. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for golang →
FAQ
ALPN stands for Application-Layer Protocol Negotiation, a TLS extension that allows the client and server to negotiate which protocol to use for communication.
If your application uses Golang and relies on the crypto/tls package for secure communications, it may inadvertently expose sensitive information during handshake failures.
Failure to address this vulnerability could lead to information disclosure, making your application more susceptible to targeted attacks.
Yes, you can use Vulert, a tool that monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
