openwrt ▾
›
openwrt-25.12 ▾
›
vulnerability
›
CVE-2026-42505
Component Overview
Vulnerability Overview
Name
CVE-2026-42505
Source
NVD (
link
)
Debian (
link
)
Description
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
CWEs
CWE-201
Published Date
Jul 8, 2026
Updated Date
Jul 13, 2026
Workaround
-
Advisories
https://go.dev/cl/775960
Patch
https://go.dev/issue/79282
Issue Tracking
https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
Mailing List
https://pkg.go.dev/vuln/GO-2026-5856
Vendor Advisory
Analysis
#
Affected Component
Analysis
golang-bootstrap
Exploitable
Vulnerability Ratings
#
5.3
CVSSv31
NaN
other
Others affected components
#
Name
Project
Project Version
Version
Status
golang-bootstrap
openwrt
master
1.24.13-r1
Exploitable
golang1.27
openwrt
master
1.27.0-r1
Not Affected
go
yocto
kirkstone
1.17.13
Exploitable
go-binary-native
yocto
kirkstone
1.17.13
Exploitable
go
yocto
master
1.26.6
Not Affected
go-binary-native
yocto
master
1.26.6
Not Affected
go
yocto
scarthgap
1.22.12
Exploitable
go-binary-native
yocto
scarthgap
1.22.12
Exploitable