Is CVE-2026-42505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42505 being exploited in the wild.

How severe is CVE-2026-42505?

Informational severity, with a CVSS score of 0, published 8 July 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.25.12,introduced=1.26.0-0,fixed=1.26.5,introduced=1.27.0-0,fixed=1.27.0-rc.2.

Is there a fix for CVE-2026-42505?

Yes. stdlib (Go): upgrade to 1.27.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42505 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42505?

Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42505: Go crypto/tls information disclosure in Encrypted Client Hello

CVE-2026-42505 · Severity: info · CVSS 0 · Published 2026-07-08

A privacy flaw was identified in the Go programming language's standard networking library. This library is used by developers to secure internet communications. An attacker monitoring network traffic could potentially identify which server a user is connecting to, even when privacy-enhancing features like Encrypted Client Hello (ECH) are enabled. This undermines the anonymity protections intended to hide user browsing habits from network observers.

Technologies: stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-42505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42505 being exploited in the wild.
How severe is CVE-2026-42505?: Informational severity, with a CVSS score of 0, published 8 July 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.25.12,introduced=1.26.0-0,fixed=1.26.5,introduced=1.27.0-0,fixed=1.27.0-rc.2.
Is there a fix for CVE-2026-42505?: Yes. stdlib (Go): upgrade to 1.27.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42505 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42505?: Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.0-rc.2 or later
```
go get stdlib@v1.27.0-rc.2
```

Technical details

A privacy vulnerability exists in the Go crypto/tls package's implementation of Encrypted Client Hello (ECH). The 'outer' (unencrypted) Client Hello message incorrectly includes pre-shared key (PSK) identities that should only be present in the 'inner' (encrypted) handshake. A passive network observer capable of capturing TLS handshakes can use these leaked identities to determine the target server's hostname, effectively bypassing the anonymity protections provided by ECH. The issue affects several core handshake functions including Conn.Handshake and Dial. Patches are available in Go versions 1.25.12, 1.26.5, and 1.27.0-rc.2.

Affected products

Go Project crypto/tls (Go standard library) < 1.25.12, >= 1.26.0-0 < 1.26.5, >= 1.27.0-0 < 1.27.0-rc.2

Identifiers

CVE-2026-42505
GO-2026-5856

Timeline

2026-05-08: other: Issue reported to Go project
2026-07-07: advisory: Go vulnerability report GO-2026-5856 published
2026-07-08: disclosed: CVE-2026-42505 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.