When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Oct 31, 2025 | Oct 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade rcloneUpgrade amazon-cloudwatch-agentUpgrade golang-miscUpgrade cri-toolsUpgrade golistUpgrade amazon-ecr-credential-helper-debuginfoUpgrade cni-plugins-debuginfoUpgrade soci-snapshotterUpgrade oci-add-hooks-debuginfoUpgrade cri-tools-debuginfoUpgrade rclone-debuginfoUpgrade containerd-debuginfoUpgrade docker-debuginfoUpgrade containerdUpgrade golist-debuginfoUpgrade runfinch-finchUpgrade amazon-ecr-credential-helperUpgrade nerdctl-debuginfoUpgrade dockerUpgrade golang-sharedUpgrade golang-testsUpgrade golang-srcUpgrade golang-binUpgrade containerd-stressUpgrade runc-debuginfoUpgrade cni-pluginsUpgrade golangUpgrade ecs-initUpgrade runcUpgrade amazon-ssm-agentUpgrade nerdctlUpgrade golang-docsUpgrade oci-add-hooks | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade libcap-debuginfoUpgrade containerd-debuginfoUpgrade docker-debuginfoUpgrade golang-testsUpgrade containerd-debugsourceUpgrade dockerUpgrade containerdUpgrade golang-sharedUpgrade amazon-ssm-agentUpgrade amazon-cloudwatch-agentUpgrade oci-add-hooks-debuginfoUpgrade soci-snapshotterUpgrade containerd-stressUpgrade runc-debuginfoUpgrade golangUpgrade containerd-stress-debuginfoUpgrade nerdctlUpgrade oci-add-hooksUpgrade golist-debugsourceUpgrade golang-binUpgrade golistUpgrade runc-debugsourceUpgrade cni-pluginsUpgrade golist-debuginfoUpgrade docker-debugsourceUpgrade golang-srcUpgrade runfinch-finchUpgrade captree-debuginfoUpgrade runcUpgrade ecs-initUpgrade libcap-develUpgrade cni-plugins-debuginfoUpgrade captreeUpgrade libcap-staticUpgrade cni-plugins-debugsourceUpgrade golang-miscUpgrade libcapUpgrade oci-add-hooks-debugsourceUpgrade libcap-debugsource | Oct 31, 2025 | Oct 29, 2025 |
| Dell Idrac | — | Upgrade Dell iDRAC to the latest version | Jun 26, 2026 | Jun 25, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 29, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.0.3Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.3.9Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 9.2.12 | Jul 30, 2026 | Oct 29, 2025 |
| Suse | — | Upgrade go1.25-raceUpgrade go1.24-raceUpgrade go1.25Upgrade go1.25-docUpgrade go1.24-docUpgrade go1.24 | Dec 5, 2025 | Oct 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub