# CVE-2026-42505: Go crypto/tls information disclosure in Encrypted Client Hello

Source: https://junglewise.ai/threats/cve-2026-42505-go-crypto-tls-information-disclosure-in-encrypted-client-hello  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-42505 · Severity: info · CVSS 0 · Published 2026-07-08

A privacy flaw was identified in the Go programming language's standard networking library. This library is used by developers to secure internet communications. An attacker monitoring network traffic could potentially identify which server a user is connecting to, even when privacy-enhancing features like Encrypted Client Hello (ECH) are enabled. This undermines the anonymity protections intended to hide user browsing habits from network observers.

Technologies: [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42505 being exploited in the wild.

**How severe is CVE-2026-42505?** Informational severity, with a CVSS score of 0, published 8 July 2026.

**Which products and versions are affected?** stdlib (Go) SEMVER:introduced=0,fixed=1.25.12,introduced=1.26.0-0,fixed=1.26.5,introduced=1.27.0-0,fixed=1.27.0-rc.2.

**Is there a fix for CVE-2026-42505?** Yes. stdlib (Go): upgrade to 1.27.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42505?** Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- stdlib (Go): upgrade to 1.27.0-rc.2 or later

  ```sh
  go get stdlib@v1.27.0-rc.2
  ```


## Technical details

A privacy vulnerability exists in the Go crypto/tls package's implementation of Encrypted Client Hello (ECH). The 'outer' (unencrypted) Client Hello message incorrectly includes pre-shared key (PSK) identities that should only be present in the 'inner' (encrypted) handshake. A passive network observer capable of capturing TLS handshakes can use these leaked identities to determine the target server's hostname, effectively bypassing the anonymity protections provided by ECH. The issue affects several core handshake functions including Conn.Handshake and Dial. Patches are available in Go versions 1.25.12, 1.26.5, and 1.27.0-rc.2.

## Affected products

- Go Project crypto/tls (Go standard library) < 1.25.12, >= 1.26.0-0 < 1.26.5, >= 1.27.0-0 < 1.27.0-rc.2

## Identifiers

- CVE-2026-42505
- GO-2026-5856

## Timeline

- 2026-05-08: other: Issue reported to Go project
- 2026-07-07: advisory: Go vulnerability report GO-2026-5856 published
- 2026-07-08: disclosed: CVE-2026-42505 published

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/775960](https://go.dev/cl/775960)
- [https://go.dev/issue/79282](https://go.dev/issue/79282)
- [https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)
- [https://pkg.go.dev/vuln/GO-2026-5856](https://pkg.go.dev/vuln/GO-2026-5856)

## Related threats

- [Go HTTP/1 server race condition in MaxBytesReader header handling](https://junglewise.ai/threats/cve-2026-97054-for-http-1-servers-when-maxbytesreader-s-limit-is-exceeded)
- [Go crypto/x509 untrusted intermediate certificate validation](https://junglewise.ai/threats/cve-2026-111943-on-most-platforms-go-uses-the-given-system-root-certificates)
- [Go crypto/tls malformed ECH extension DoS](https://junglewise.ai/threats/cve-2026-97031-go-2026-6607-reject-malformed-ech-outer-extension-references-in)
- [Go html/template XSS via missing ES2015+ keywords](https://junglewise.ai/threats/cve-2026-97030-go-2026-6600-recognize-yield-as-regexp-preceder-keyword-in-html)
- [Go html/template XSS via stale context in consecutive expressions](https://junglewise.ai/threats/cve-2026-94448-go-2026-6599-reset-context-tracking-on-consecutive-template)