MEDIUM5.3

GO-2025-4008

ALPN negotiation error contains attacker controlled information in crypto/tls

Quick fix

GO-2025-4008 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.24.8

Details

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.24.8

Fixgo get stdlib@v1.24.8

References

https://go.dev/cl/707776[FIX]
https://go.dev/issue/75652[REPORT]
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI[WEB]