Bug 2498138 (CVE-2026-42505)

Summary: CVE-2026-42505 crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, akhatavk, akostadi, akoudelk, alizardo, amasferr, amctagga, anjoseph, anpicker, ansmith, anthomas, aoconnor, aos-team-art-private, aruklets, asatyam, asdas, bbrownin, bniver, chfoley, ckandaga, cmah, crizzo, dakwon, dhanak, diagrawa, dkeler, dmayorov, doconnor, dpaolell, drosa, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, flucifre, gbenhaim, ggainey, gmeno, gparvin, groman, hasun, ibolton, ikhan, jbalunas, jbritton, jburrell, jcantril, jchui, jdelft, jeder, jfula, jhe, jjoyce, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jolong, jowilson, jpasqual, jprabhak, jpretori, jschluet, jtolenti, jturenov, jupierce, juwatts, kingland, kshier, ktsao, lball, lbragsta, lchilton, lgamliel, lgarciaa, lhh, manissin, mbenjamin, mbiarnes, mbocek, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, mrunge, mwringe, nboldt, ngough, niyer, nmoumoul, nyancey, oaljalju, ometelka, osousa, pantinor, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, pvasanth, rbobbitt, rchan, rekumar, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rojacob, sabiswas, sakbas, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sostapov, sseago, stcannon, suppawar, swoodman, syedriko, teagle, thason, tmalecek, tsedmik, tsze, twaugh, tzivkovi, vereddy, veshanka, vimartin, vkarehfa, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-08 17:01:28 UTC 
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.