During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade image-builderUpgrade libslirp-develUpgrade opentelemetry-collectorUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade crunUpgrade grafana-pcpUpgrade delveUpgrade skopeo-testsUpgrade containers-commonUpgrade git-lfsUpgrade libslirpUpgrade go-toolsetUpgrade grafanaUpgrade osbuild-composer-workerUpgrade criu-libsUpgrade golang-docsUpgrade container-selinuxUpgrade criu-develUpgrade podman-pluginsUpgrade conmonUpgrade golang-miscUpgrade buildahUpgrade buildah-testsUpgrade toolboxUpgrade criuUpgrade osbuild-composerUpgrade podmanUpgrade podman-testsUpgrade runcUpgrade aardvark-dnsUpgrade python3-podmanUpgrade cockpit-podmanUpgrade golangUpgrade podman-gvproxyUpgrade golang-binUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade golang-srcUpgrade podman-dockerUpgrade osbuild-composer-coreUpgrade skopeoUpgrade grafana-selinuxUpgrade toolbox-testsUpgrade golang-raceUpgrade golang-testsUpgrade critUpgrade udicaUpgrade podman-catatonitUpgrade podman-remoteUpgrade netavarkUpgrade fuse-overlayfs | Feb 17, 2026 | Feb 16, 2026 |
| Alpine Linux | — | Upgrade rcloneUpgrade go | Feb 6, 2026 | Feb 5, 2026 |
| Amazon Linux Ami 2 | — | Upgrade amazon-ecr-credential-helper-debuginfoUpgrade containerd-stressUpgrade cri-tools-debuginfoUpgrade golang-docsUpgrade soci-snapshotterUpgrade runfinch-finchUpgrade cri-toolsUpgrade docker-debuginfoUpgrade dockerUpgrade golang-srcUpgrade containerdUpgrade golangUpgrade oci-add-hooksUpgrade amazon-cloudwatch-agentUpgrade golang-github-cpuguy83-go-md2manUpgrade golang-sharedUpgrade amazon-ecr-credential-helperUpgrade runcUpgrade runc-debuginfoUpgrade golang-testsUpgrade golistUpgrade containerd-debuginfoUpgrade cni-pluginsUpgrade golist-debuginfoUpgrade golang-miscUpgrade ecs-initUpgrade oci-add-hooks-debuginfoUpgrade golang-binUpgrade cni-plugins-debuginfoUpgrade nerdctl-debuginfoUpgrade nerdctl | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade captree-debuginfoUpgrade golang-docsUpgrade ecs-initUpgrade docker-debugsourceUpgrade nerdctlUpgrade golang-srcUpgrade oci-add-hooksUpgrade amazon-cloudwatch-agentUpgrade containerd-stressUpgrade libcap-debugsourceUpgrade libcap-staticUpgrade oci-add-hooks-debuginfoUpgrade golang-miscUpgrade golist-debuginfoUpgrade runfinch-finchUpgrade cni-plugins-debugsourceUpgrade libcap-debuginfoUpgrade runc-debugsourceUpgrade docker-debuginfoUpgrade golistUpgrade cni-pluginsUpgrade golangUpgrade containerdUpgrade golang-binUpgrade oci-add-hooks-debugsourceUpgrade golist-debugsourceUpgrade dockerUpgrade soci-snapshotterUpgrade cni-plugins-debuginfoUpgrade libcapUpgrade golang-testsUpgrade captreeUpgrade runc-debuginfoUpgrade containerd-debugsourceUpgrade containerd-stress-debuginfoUpgrade runcUpgrade containerd-debuginfoUpgrade amazon-ecr-credential-helperUpgrade libcap-develUpgrade golang-shared | Feb 19, 2026 | Feb 5, 2026 |
| Freebsd | — | Upgrade oauth2-proxy | Mar 2, 2026 | Feb 27, 2026 |
| Oracle_linux | — | Upgrade image-builderUpgrade criu-libsUpgrade golang-srcUpgrade podmanUpgrade buildahUpgrade conmonUpgrade netavarkUpgrade grafana-pcpUpgrade golang-testsUpgrade podman-catatonitUpgrade osbuild-composer-coreUpgrade containers-commonUpgrade grafana-selinuxUpgrade libslirpUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade golang-raceUpgrade yggdrasil-develUpgrade skopeoUpgrade golang-miscUpgrade ipp-usbUpgrade buildah-testsUpgrade criuUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade python3-podmanUpgrade criu-develUpgrade containernetworking-pluginsUpgrade runcUpgrade podman-remoteUpgrade podman-dockerUpgrade osbuild-composerUpgrade grafanaUpgrade critUpgrade podman-gvproxyUpgrade delveUpgrade podman-pluginsUpgrade golang-docsUpgrade podman-testsUpgrade container-selinuxUpgrade slirp4netnsUpgrade yggdrasilUpgrade golang-binUpgrade crunUpgrade git-lfsUpgrade go-toolsetUpgrade udicaUpgrade python3-criuUpgrade osbuild-composer-workerUpgrade skopeo-tests | Feb 24, 2026 | Feb 5, 2026 |
| Redhat Openshift | — | Upgrade podmanUpgrade skopeoUpgrade ose-aws-ecr-image-credential-providerUpgrade openshiftUpgrade containernetworking-pluginsUpgrade openshift-clientsUpgrade runc | Aug 10, 2026 | Feb 5, 2026 |
| Redhat_linux | — | Upgrade podman-gvproxyUpgrade osbuild-composer-debugsourceUpgrade toolbox-debuginfoUpgrade gvisor-tap-vsock-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade python3-criuUpgrade buildah-testsUpgrade yggdrasil-debugsourceUpgrade grafana-debugsourceUpgrade rhc-worker-playbook-debugsourceUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade podman-remoteUpgrade yggdrasil-develUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade osbuild-composer-debuginfoUpgrade aardvark-dnsUpgrade podman-gvproxy-debuginfoUpgrade yggdrasilUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade git-lfs-debuginfoUpgrade go-fdo-serverUpgrade podman-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade criu-libsUpgrade go-fdo-server-rendezvousUpgrade osbuild-composer-worker-debuginfoUpgrade yggdrasil-debuginfoUpgrade grafana-pcpUpgrade conmon-debuginfoUpgrade gvisor-tap-vsock-gvforwarderUpgrade criu-debugsourceUpgrade go-toolsetUpgrade golang-binUpgrade delveUpgrade criu-develUpgrade containers-commonUpgrade grafanaUpgrade rhc-develUpgrade podman-plugins-debuginfoUpgrade crun-debuginfoUpgrade udicaUpgrade toolbox-debugsourceUpgrade golang-docsUpgrade podman-dockerUpgrade runc-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debugsourceUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade osbuild-composerUpgrade critUpgrade git-lfsUpgrade ipp-usbUpgrade opentelemetry-collectorUpgrade osbuild-composer-tests-debuginfoUpgrade rhc-debuginfoUpgrade slirp4netnsUpgrade osbuild-composer-workerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debuginfoUpgrade cockpit-podmanUpgrade runcUpgrade golang-raceUpgrade git-lfs-debugsourceUpgrade buildah-debuginfoUpgrade go-fdo-server-ownerUpgrade crunUpgrade go-fdo-server-debuginfoUpgrade delve-debugsourceUpgrade libslirpUpgrade golangUpgrade rhc-debugsourceUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade image-builder-debuginfoUpgrade python3-podmanUpgrade gvisor-tap-vsock-debuginfoUpgrade gvisor-tap-vsockUpgrade image-builder-debugsourceUpgrade delve-debuginfoUpgrade podmanUpgrade grafana-selinuxUpgrade rhc-worker-playbook-debuginfoUpgrade yggdrasil-examples-debuginfoUpgrade podman-pluginsUpgrade criuUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade grafana-debuginfoUpgrade rhc-worker-playbookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-testsUpgrade podman-tests-debuginfoUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade buildahUpgrade fuse-overlayfsUpgrade podman-testsUpgrade skopeoUpgrade go-fdo-server-manufacturerUpgrade netavarkUpgrade grafana-pcp-debuginfoUpgrade golang-testsUpgrade rhcUpgrade fuse-overlayfs-debugsourceUpgrade conmonUpgrade go-fdo-client-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade golang-miscUpgrade go-fdo-clientUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade grafana-pcp-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-catatonitUpgrade toolboxUpgrade osbuild-composer-dnf-jsonUpgrade ipp-usb-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-coreUpgrade image-builderUpgrade gvisor-tap-vsock-gvforwarder-debuginfoUpgrade golang-srcUpgrade go-fdo-server-debugsourceUpgrade go-fdo-client-debuginfo | Feb 17, 2026 | Feb 5, 2026 |
| Rocky_linux | — | Upgrade criu-develUpgrade grafana-pcp-debuginfoUpgrade podman-remote-debuginfoUpgrade osbuild-composerUpgrade podman-catatonitUpgrade podman-gvproxy-debuginfoUpgrade podman-pluginsUpgrade podman-remoteUpgrade golang-binUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade go-fdo-clientUpgrade opentelemetry-collectorUpgrade podman-tests-debuginfoUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade yggdrasil-develUpgrade buildah-debugsourceUpgrade delve-debugsourceUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade git-lfs-debuginfoUpgrade podman-plugins-debuginfoUpgrade python3-criuUpgrade toolbox-debugsourceUpgrade skopeoUpgrade crun-debugsourceUpgrade podman-debuginfoUpgrade criuUpgrade containers-commonUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade go-fdo-client-debuginfoUpgrade libslirp-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade delveUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafana-debugsourceUpgrade podman-catatonit-debuginfoUpgrade image-builder-debuginfoUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade grafana-pcpUpgrade grafana-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade osbuild-composer-workerUpgrade buildah-debuginfoUpgrade containernetworking-pluginsUpgrade grafana-debuginfoUpgrade image-builderUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade skopeo-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade podmanUpgrade yggdrasil-debugsourceUpgrade runcUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade podman-gvproxyUpgrade podman-testsUpgrade go-toolsetUpgrade golangUpgrade libslirpUpgrade grafanaUpgrade conmon-debuginfoUpgrade image-builder-debugsourceUpgrade netavarkUpgrade conmon-debugsourceUpgrade skopeo-debuginfoUpgrade osbuild-composer-debugsourceUpgrade go-fdo-server-debugsourceUpgrade ipp-usb-debuginfoUpgrade crun-debuginfoUpgrade buildah-tests-debuginfoUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade toolboxUpgrade ipp-usbUpgrade grafana-pcp-debugsourceUpgrade libslirp-develUpgrade buildah-testsUpgrade yggdrasilUpgrade golang-raceUpgrade crunUpgrade skopeo-testsUpgrade slirp4netnsUpgrade go-fdo-server-debuginfoUpgrade go-fdo-client-debugsourceUpgrade git-lfs-debugsourceUpgrade git-lfsUpgrade conmonUpgrade slirp4netns-debugsourceUpgrade criu-libsUpgrade yggdrasil-debuginfoUpgrade runc-debuginfoUpgrade osbuild-composer-debuginfoUpgrade criu-debuginfoUpgrade osbuild-composer-coreUpgrade go-fdo-server | Feb 19, 2026 | Feb 17, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 10.4.0Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 9.4.12Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.4.11 | Jul 30, 2026 | Feb 5, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 5, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub