During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containers-commonUpgrade osbuild-composer-workerUpgrade criu-libsUpgrade podman-pluginsUpgrade criu-develUpgrade opentelemetry-collectorUpgrade image-builderUpgrade delveUpgrade crunUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade go-toolsetUpgrade golang-docsUpgrade libslirpUpgrade libslirp-develUpgrade grafanaUpgrade container-selinuxUpgrade python3-criuUpgrade git-lfsUpgrade grafana-pcpUpgrade criuUpgrade osbuild-composerUpgrade podmanUpgrade golangUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade critUpgrade podman-gvproxyUpgrade golang-binUpgrade golang-testsUpgrade toolboxUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade conmonUpgrade podman-testsUpgrade runcUpgrade buildah-testsUpgrade podman-remoteUpgrade netavarkUpgrade udicaUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade golang-miscUpgrade skopeoUpgrade golang-srcUpgrade podman-dockerUpgrade golang-raceUpgrade buildahUpgrade osbuild-composer-coreUpgrade grafana-selinux | Feb 17, 2026 | Feb 16, 2026 |
| Alpine Linux | — | Upgrade goUpgrade rclone | Feb 6, 2026 | Feb 5, 2026 |
| Amazon Linux Ami 2 | — | Upgrade containerd-stressUpgrade soci-snapshotterUpgrade golang-docsUpgrade runfinch-finchUpgrade cri-toolsUpgrade docker-debuginfoUpgrade amazon-ecr-credential-helper-debuginfoUpgrade cri-tools-debuginfoUpgrade dockerUpgrade containerdUpgrade runc-debuginfoUpgrade oci-add-hooksUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade golang-srcUpgrade cni-plugins-debuginfoUpgrade golang-sharedUpgrade golang-github-cpuguy83-go-md2manUpgrade runcUpgrade golistUpgrade nerdctl-debuginfoUpgrade golang-miscUpgrade golangUpgrade oci-add-hooks-debuginfoUpgrade golang-testsUpgrade golang-binUpgrade golist-debuginfoUpgrade ecs-initUpgrade cni-pluginsUpgrade amazon-ecr-credential-helperUpgrade containerd-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ecs-initUpgrade captree-debuginfoUpgrade golangUpgrade golang-docsUpgrade libcap-debuginfoUpgrade cni-pluginsUpgrade golang-srcUpgrade docker-debugsourceUpgrade golist-debuginfoUpgrade golistUpgrade nerdctlUpgrade containerd-stressUpgrade runfinch-finchUpgrade amazon-cloudwatch-agentUpgrade docker-debuginfoUpgrade libcap-debugsourceUpgrade libcap-staticUpgrade oci-add-hooks-debuginfoUpgrade cni-plugins-debugsourceUpgrade runc-debugsourceUpgrade oci-add-hooksUpgrade golang-miscUpgrade containerd-debugsourceUpgrade runcUpgrade runc-debuginfoUpgrade libcap-develUpgrade cni-plugins-debuginfoUpgrade libcapUpgrade golang-testsUpgrade golang-binUpgrade golang-sharedUpgrade containerd-stress-debuginfoUpgrade dockerUpgrade containerdUpgrade captreeUpgrade oci-add-hooks-debugsourceUpgrade amazon-ecr-credential-helperUpgrade containerd-debuginfoUpgrade golist-debugsourceUpgrade soci-snapshotter | Feb 19, 2026 | Feb 5, 2026 |
| Freebsd | — | Upgrade oauth2-proxy | Mar 2, 2026 | Feb 27, 2026 |
| Oracle_linux | — | Upgrade podman-testsUpgrade criu-develUpgrade golang-docsUpgrade crunUpgrade udicaUpgrade podman-pluginsUpgrade git-lfsUpgrade go-toolsetUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade yggdrasilUpgrade osbuild-composer-workerUpgrade osbuild-composerUpgrade podman-gvproxyUpgrade podman-dockerUpgrade grafanaUpgrade delveUpgrade critUpgrade skopeo-testsUpgrade runcUpgrade podman-remoteUpgrade golang-binUpgrade python3-criuUpgrade podman-catatonitUpgrade python3-podmanUpgrade skopeoUpgrade buildah-testsUpgrade osbuild-composer-coreUpgrade golang-srcUpgrade golang-testsUpgrade netavarkUpgrade containers-commonUpgrade grafana-pcpUpgrade conmonUpgrade aardvark-dnsUpgrade podmanUpgrade fuse-overlayfsUpgrade yggdrasil-develUpgrade golang-raceUpgrade criuUpgrade cockpit-podmanUpgrade grafana-selinuxUpgrade golang-miscUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade criu-libsUpgrade libslirp-develUpgrade golangUpgrade image-builderUpgrade buildahUpgrade ipp-usb | Feb 24, 2026 | Feb 5, 2026 |
| Redhat Openshift | — | Upgrade podmanUpgrade openshift-clientsUpgrade skopeoUpgrade ose-aws-ecr-image-credential-providerUpgrade runcUpgrade containernetworking-pluginsUpgrade openshift | Aug 10, 2026 | Feb 5, 2026 |
| Redhat_linux | — | Upgrade go-fdo-serverUpgrade podman-debuginfoUpgrade gvisor-tap-vsock-gvforwarderUpgrade containers-commonUpgrade criu-libsUpgrade go-fdo-server-rendezvousUpgrade criu-debugsourceUpgrade rhc-debuginfoUpgrade yggdrasil-develUpgrade ipp-usbUpgrade oci-seccomp-bpf-hookUpgrade runc-debuginfoUpgrade podman-dockerUpgrade slirp4netnsUpgrade rhc-develUpgrade criu-libs-debuginfoUpgrade golang-docsUpgrade toolbox-debugsourceUpgrade rhc-worker-playbook-debugsourceUpgrade udicaUpgrade criu-develUpgrade osbuild-composerUpgrade osbuild-composer-debugsourceUpgrade delveUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade opentelemetry-collectorUpgrade yggdrasil-debugsourceUpgrade buildah-testsUpgrade container-selinuxUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade cockpit-podmanUpgrade critUpgrade git-lfsUpgrade yggdrasilUpgrade python3-criuUpgrade runcUpgrade grafana-debugsourceUpgrade gvisor-tap-vsock-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade libslirp-develUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade yggdrasil-debuginfoUpgrade conmon-debuginfoUpgrade golang-binUpgrade podman-gvproxy-debuginfoUpgrade runc-debugsourceUpgrade git-lfs-debuginfoUpgrade skopeo-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade aardvark-dnsUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-workerUpgrade podman-remoteUpgrade grafana-pcpUpgrade containernetworking-pluginsUpgrade grafanaUpgrade osbuild-composer-debuginfoUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade golang-miscUpgrade osbuild-composer-core-debuginfoUpgrade crunUpgrade podman-remote-debuginfoUpgrade grafana-pcp-debuginfoUpgrade golang-testsUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade conmonUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade libslirpUpgrade go-fdo-client-debugsourceUpgrade rhc-debugsourceUpgrade golangUpgrade go-fdo-server-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade go-fdo-server-debugsourceUpgrade netavarkUpgrade grafana-debuginfoUpgrade fuse-overlayfsUpgrade ipp-usb-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade git-lfs-debugsourceUpgrade image-builder-debuginfoUpgrade gvisor-tap-vsock-gvforwarder-debuginfoUpgrade golang-srcUpgrade golang-raceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-testsUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade go-fdo-server-manufacturerUpgrade rhc-worker-playbook-debuginfoUpgrade podman-pluginsUpgrade podmanUpgrade grafana-selinuxUpgrade delve-debuginfoUpgrade yggdrasil-examples-debuginfoUpgrade skopeoUpgrade podman-testsUpgrade buildah-tests-debuginfoNo solution existsUpgrade toolboxUpgrade podman-catatonitUpgrade grafana-pcp-debugsourceUpgrade go-fdo-clientUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-composer-coreUpgrade image-builderUpgrade go-fdo-client-debuginfoUpgrade delve-debugsourceUpgrade buildah-debuginfoUpgrade podman-tests-debuginfoUpgrade go-fdo-server-ownerUpgrade gvisor-tap-vsockUpgrade python3-podmanUpgrade skopeo-debugsourceUpgrade image-builder-debugsourceUpgrade conmon-debugsourceUpgrade buildahUpgrade gvisor-tap-vsock-debuginfoUpgrade rhc-worker-playbookUpgrade rhc | Feb 17, 2026 | Feb 5, 2026 |
| Rocky_linux | — | Upgrade go-fdo-client-debugsourceUpgrade skopeo-testsUpgrade git-lfs-debugsourceUpgrade slirp4netnsUpgrade buildah-testsUpgrade go-fdo-server-debuginfoUpgrade grafana-pcp-debugsourceUpgrade conmon-debuginfoUpgrade conmon-debugsourceUpgrade netavarkUpgrade osbuild-composer-debugsourceUpgrade skopeo-debuginfoUpgrade crunUpgrade golang-raceUpgrade yggdrasilUpgrade go-toolsetUpgrade libslirp-develUpgrade image-builder-debugsourceUpgrade slirp4netns-debugsourceUpgrade conmonUpgrade osbuild-composer-debuginfoUpgrade runc-debuginfoUpgrade yggdrasil-debuginfoUpgrade criu-debuginfoUpgrade go-fdo-serverUpgrade git-lfsUpgrade osbuild-composer-coreUpgrade osbuild-composer-core-debuginfoUpgrade podman-testsUpgrade toolboxUpgrade golangUpgrade criu-libsUpgrade grafanaUpgrade ipp-usbUpgrade libslirpUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade ipp-usb-debuginfoUpgrade buildah-tests-debuginfoUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade crun-debuginfoUpgrade buildahUpgrade go-fdo-server-debugsourceUpgrade buildah-debugsourceUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade grafana-selinuxUpgrade skopeo-debugsourceUpgrade go-fdo-client-debuginfoUpgrade criu-debugsourceUpgrade aardvark-dnsUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade toolbox-debuginfoUpgrade skopeoUpgrade grafana-pcp-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade delve-debugsourceUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade podman-catatonitUpgrade osbuild-composerUpgrade critUpgrade yggdrasil-develUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade podman-remoteUpgrade podman-tests-debuginfoUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade opentelemetry-collectorUpgrade golang-binUpgrade go-fdo-clientUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runcUpgrade osbuild-composer-worker-debuginfoUpgrade libslirp-debugsourceUpgrade image-builder-debuginfoUpgrade grafana-debugsourceUpgrade grafana-debuginfoUpgrade delveUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfsUpgrade image-builderUpgrade containers-commonUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade git-lfs-debuginfoUpgrade delve-debuginfoUpgrade podmanUpgrade criuUpgrade yggdrasil-debugsourceUpgrade python3-criuUpgrade grafana-pcpUpgrade osbuild-composer-worker | Feb 19, 2026 | Feb 17, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 10.4.0Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.4.12 | Jul 30, 2026 | Feb 5, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 5, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub