Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T15:46:33 crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-201

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.

This Moderate-impact information disclosure flaw in the Go `crypto/tls` package allows a passive network observer to de-anonymize connections utilizing Encrypted Client Hello (ECH). The vulnerability stems from the unintentional exposure of pre-shared key identities within the unencrypted client hello, potentially enabling an attacker to link previously anonymous connections. This primarily affects the privacy of communications rather than integrity or availability. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 2026-07-09T00:00:00Z RHSA-2026:37436 golang-0:1.26.5-1.el10_2 Red Hat Enterprise Linux 8 2026-07-13T00:00:00Z RHSA-2026:38995 go-toolset:rhel8-8100020260710105056.a3795dee Red Hat Enterprise Linux 9 2026-07-09T00:00:00Z RHSA-2026:37435 golang-0:1.26.5-1.el9_8 Red Hat Hardened Images 2026-07-08T00:00:00Z RHSA-2026:36477 golang1-26-main-1.26.5-0.1.hum1 Red Hat Hardened Images 2026-07-08T00:00:00Z RHSA-2026:36510 golang1-25-main-1.25.12-0.1.hum1 Assisted Installer for Red Hat OpenShift Container Platform 2 Fix deferred rhai/assisted-installer-rhel9 Builds for Red Hat OpenShift Under investigation openshift-builds/openshift-builds-waiters-rhel9 cert-manager Operator for Red Hat OpenShift Fix deferred cert-manager/jetstack-cert-manager-rhel9 Compliance Operator Fix deferred compliance/openshift-compliance-operator-bundle Confidential Compute Attestation Fix deferred build-of-trustee/trustee-rhel9-operator Confidential Compute Attestation Fix deferred openshift-sandboxed-containers/osc-monitor-rhel9 Cryostat 4 Under investigation cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Fix deferred custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Deployment Validation Operator Fix deferred dvo/deployment-validation-rhel8-operator External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-rhel9 Fence Agents Remediation Operator Fix deferred workload-availability/fence-agents-remediation-rhel8-operator File Integrity Operator Fix deferred compliance/openshift-compliance-operator-bundle Gatekeeper 3 Under investigation gatekeeper/gatekeeper-rhel9-operator Logging Subsystem for Red Hat OpenShift Fix deferred openshift-logging/eventrouter-rhel9 Logical Volume Manager Storage Fix deferred lvms4/lvms-rhel9-operator Logical Volume Manager Storage Fix deferred lvms4/topolvm-rhel8 Logical Volume Manager Storage Fix deferred lvms4/topolvm-rhel9 Machine Deletion Remediation Operator Fix deferred workload-availability/machine-deletion-remediation-rhel8-operator Migration Toolkit for Applications 8 Fix deferred mta/mta-cli-rhel9 Migration Toolkit for Containers Fix deferred rhmtc/openshift-migration-registry-rhel8 mirror registry for Red Hat OpenShift 2 Fix deferred openshift/mirror-registry-rhel8 Multiarch Tuning Operator Fix deferred multiarch-tuning/multiarch-tuning-rhel9-operator Multicluster Engine for Kubernetes Under investigation multicluster-engine/discovery-rhel9 Multicluster Engine for Kubernetes Under investigation multicluster-engine/maestro-rhel9 Multicluster Global Hub Under investigation multicluster-globalhub/multicluster-globalhub-agent-rhel9 Network Observability Operator Fix deferred network-observability/network-observability-cli-rhel9 Node HealthCheck Operator Fix deferred node-healthcheck-operator-tech-preview/node-healthcheck-operator-rhel8 OpenShift API for Data Protection Fix deferred oadp/oadp-velero-rhel9 OpenShift Developer Tools and Services Fix deferred helm OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-rhel9-operator OpenShift Pipelines Fix deferred openshift-pipelines-client OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-scheduler-rhel9 OpenShift Serverless Fix deferred kn-workflow-plugin OpenShift Serverless Fix deferred openshift-serverless-1/kn-plugin-event-sender-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/logic-rhel9-operator OpenShift Serverless Fix deferred openshift-serverless-clients OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Fix deferred rh-osbs/openshift-golang-builder OpenShift Source-to-Image (S2I) Fix deferred source-to-image/source-to-image-rhel8 Power monitoring for Red Hat OpenShift Fix deferred openshift-power-monitoring/kepler-rhel9 Red Hat 3scale API Management Platform 2 Under investigation 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/subctl-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation rhacm2/thanos-rhel9 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-main-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-26/receptor-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-27/receptor-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform/platform-operator-bundle Red Hat Ansible Automation Platform 2 Under investigation automation-gateway-proxy Red Hat Ansible Automation Platform 2 Under investigation automation-gateway-proxy-openssl30 Red Hat Ansible Automation Platform 2 Under investigation automation-gateway-proxy-openssl32 Red Hat Ansible Automation Platform 2 Under investigation python3.11-galaxy-ng Red Hat Ansible Automation Platform 2 Under investigation python3.11-grpcio Red Hat Ansible Automation Platform 2 Under investigation python3.12-galaxy-ng Red Hat Ansible Automation Platform 2 Under investigation python3.12-grpcio Red Hat Ansible Automation Platform 2 Under investigation python3x-grpcio Red Hat Ansible Automation Platform 2 Under investigation python-grpcio Red Hat Ansible Automation Platform 2 Under investigation receptor Red Hat Ceph Storage 5 Under investigation rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 Under investigation rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 7 Under investigation rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Under investigation rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Under investigation rhceph/alloy-rhel10 Red Hat Connectivity Link 1 Under investigation rhcl-1/authorino-rhel9 Red Hat Connectivity Link 1 Under investigation rhcl-1/coredns-rhel9 Red Hat Developer Hub Fix deferred rhdh/rhdh-rhel9-operator Red Hat Edge Manager 1 Under investigation flightctl Red Hat Edge Manager 1 Under investigation rhem/flightctl-ui-rhel9 Red Hat Enterprise Linux 10 Under investigation buildah Red Hat Enterprise Linux 10 Under investigation butane Red Hat Enterprise Linux 10 Under investigation conmon Red Hat Enterprise Linux 10 Under investigation delve Red Hat Enterprise Linux 10 Under investigation git-lfs Red Hat Enterprise Linux 10 Under investigation go-fdo-client Red Hat Enterprise Linux 10 Under investigation go-fdo-server Red Hat Enterprise Linux 10 Under investigation golang-github-openprinting-ipp-usb Red Hat Enterprise Linux 10 Under investigation grafana Red Hat Enterprise Linux 10 Under investigation grafana-pcp Red Hat Enterprise Linux 10 Under investigation gvisor-tap-vsock Red Hat Enterprise Linux 10 Under investigation ignition Red Hat Enterprise Linux 10 Under investigation image-builder Red Hat Enterprise Linux 10 Under investigation opentelemetry-collector Red Hat Enterprise Linux 10 Under investigation osbuild-composer Red Hat Enterprise Linux 10 Under investigation podman Red Hat Enterprise Linux 10 Under investigation rhc Red Hat Enterprise Linux 10 Under investigation rhc-worker-playbook Red Hat Enterprise Linux 10 Under investigation rhel10/bootc-image-builder Red Hat Enterprise Linux 10 Under investigation rhel10-eus/rhel-10.0-bootc-image-builder Red Hat Enterprise Linux 10 Under investigation skopeo Red Hat Enterprise Linux 10 Under investigation toolbox Red Hat Enterprise Linux 10 Under investigation trustee Red Hat Enterprise Linux 10 Under investigation trustee-guest-components Red Hat Enterprise Linux 10 Under investigation yggdrasil Red Hat Enterprise Linux 7 Under investigation host-metering Red Hat Enterprise Linux 7 Under investigation rhc Red Hat Enterprise Linux 7 Under investigation rhc-worker-script Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/buildah Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/conmon Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/containernetworking-plugins Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/podman Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/runc Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/skopeo Red Hat Enterprise Linux 8 Under investigation container-tools:rhel8/toolbox Red Hat Enterprise Linux 8 Under investigation git-lfs Red Hat Enterprise Linux 8 Under investigation grafana Red Hat Enterprise Linux 8 Under investigation grafana-pcp Red Hat Enterprise Linux 8 Under investigation osbuild-composer Red Hat Enterprise Linux 8 Under investigation rhc Red Hat Enterprise Linux 8 Under investigation weldr-client Red Hat Enterprise Linux 9 Under investigation buildah Red Hat Enterprise Linux 9 Under investigation butane Red Hat Enterprise Linux 9 Under investigation conmon Red Hat Enterprise Linux 9 Under investigation containernetworking-plugins Red Hat Enterprise Linux 9 Under investigation git-lfs Red Hat Enterprise Linux 9 Under investigation grafana Red Hat Enterprise Linux 9 Under investigation grafana-pcp Red Hat Enterprise Linux 9 Under investigation gvisor-tap-vsock Red Hat Enterprise Linux 9 Under investigation ignition Red Hat Enterprise Linux 9 Under investigation image-builder Red Hat Enterprise Linux 9 Under investigation opentelemetry-collector Red Hat Enterprise Linux 9 Under investigation osbuild-composer Red Hat Enterprise Linux 9 Under investigation podman Red Hat Enterprise Linux 9 Under investigation rhc Red Hat Enterprise Linux 9 Under investigation rhel9/bootc-image-builder Red Hat Enterprise Linux 9 Under investigation rhel9-eus/rhel-9.6-bootc-image-builder Red Hat Enterprise Linux 9 Under investigation runc Red Hat Enterprise Linux 9 Under investigation skopeo Red Hat Enterprise Linux 9 Under investigation toolbox Red Hat Enterprise Linux 9 Under investigation trustee-guest-components Red Hat Enterprise Linux 9 Under investigation weldr-client Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred golang Red Hat Hardened Images Not affected golang-fips1.25 Red Hat Lightspeed for Runtimes Operator Under investigation rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-rhel9-operator Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/rhai-cli-rhel9 Red Hat OpenShift Cluster Manager CLI Fix deferred ocm-cli-clients/ocm-cli-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred butane Red Hat OpenShift Container Platform 4 Fix deferred conmon Red Hat OpenShift Container Platform 4 Fix deferred conmon-rs Red Hat OpenShift Container Platform 4 Fix deferred containernetworking-plugins Red Hat OpenShift Container Platform 4 Fix deferred cri-o Red Hat OpenShift Container Platform 4 Fix deferred cri-tools Red Hat OpenShift Container Platform 4 Fix deferred golang-github-prometheus-promu Red Hat OpenShift Container Platform 4 Fix deferred ignition Red Hat OpenShift Container Platform 4 Fix deferred kata-containers Red Hat OpenShift Container Platform 4 Fix deferred microshift Red Hat OpenShift Container Platform 4 Fix deferred openshift Red Hat OpenShift Container Platform 4 Fix deferred openshift4/frr-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-cli Red Hat OpenShift Container Platform 4 Fix deferred openshift-clients Red Hat OpenShift Container Platform 4 Fix deferred openshift-kuryr Red Hat OpenShift Container Platform 4 Fix deferred ose-aws-ecr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred ose-azure-acr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred ose-crio-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred ose-gcp-gcr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred podman Red Hat OpenShift Container Platform 4 Fix deferred rh-osbs/openshift-golang-builder Red Hat OpenShift Container Platform 4 Fix deferred runc Red Hat OpenShift Container Platform 4 Fix deferred skopeo Red Hat Openshift Data Foundation 4 Under investigation odf4/cephcsi-rhel9 Red Hat OpenShift Dev Spaces Under investigation devspaces/udi-rhel9 Red Hat OpenShift Dev Workspaces Operator Under investigation devworkspace/devworkspace-rhel9-operator Red Hat OpenShift distributed tracing 3 Fix deferred rhosdt/tempo-rhel9 Red Hat OpenShift for Windows Containers Fix deferred openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/dex-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/dex-rhel9 Red Hat OpenShift on AWS Fix deferred rosa Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubevirt-apiserver-proxy-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubevirt-redfish-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred kubevirt Red Hat OpenShift Virtualization 4 Fix deferred rh-osbs/openshift-golang-builder Red Hat OpenStack Platform 16.2 Fix deferred etcd Red Hat OpenStack Platform 16.2 Fix deferred golang-github-infrawatch-apputils Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/osp-director-agent Red Hat OpenStack Platform 17.1 Fix deferred collectd-libpod-stats Red Hat OpenStack Platform 17.1 Fix deferred etcd Red Hat OpenStack Platform 17.1 Fix deferred golang-github-infrawatch-apputils Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/osp-director-agent Red Hat OpenStack Platform 18.0 Fix deferred golang-github-openstack-k8s-operators-os-diff Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/sg-core-rhel9 Red Hat Quay 3 Fix deferred quay/quay-rhel8 Red Hat Quay 3 Fix deferred quay/quay-rhel9 Red Hat Satellite 6 Under investigation satellite:el8/yggdrasil-worker-forwarder Red Hat Satellite 6 Under investigation satellite/iop-vmaas-rhel9 Red Hat Satellite 6 Under investigation yggdrasil-worker-forwarder Red Hat Service Interconnect 2 Under investigation skupper-cli Red Hat Trusted Artifact Signer Fix deferred rhtas/ec-rhel9 Red Hat Web Terminal Under investigation web-terminal/web-terminal-exec-rhel9 Security Profiles Operator Fix deferred compliance/openshift-selinuxd-rhel8 Service Telemetry Framework 1.5 Fix deferred stf/sg-core-rhel9 streams for Apache Kafka 2 Under investigation golang-github-danielqsj-kafka_exporter streams for Apache Kafka 3 Under investigation golang-github-danielqsj-kafka_exporter Zero Trust Workload Identity Manager Fix deferred zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9 Zero Trust Workload Identity Manager - Tech Preview Fix deferred zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-42505 https://nvd.nist.gov/vuln/detail/CVE-2026-42505 https://go.dev/cl/775960 https://go.dev/issue/79282 https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc https://pkg.go.dev/vuln/GO-2026-5856