CVE-2026-42505: Encrypted Client Hello Pre-Shared Key Disclosure in Go

Technical summary

CVE-2026-42505 stems from improper information disclosure (CWE-201) in the TLS handshake flow when Encrypted Client Hello is negotiated. The ECH extension was introduced to encrypt sensitive ClientHello fields from passive observers; however, pre-shared key session resumption identities (PSK bindings) are transmitted in plaintext as part of the unencrypted ClientHello frame. An attacker positioned to observe network traffic can extract these PSK identities and use them to build a profile of client behavior across sessions, defeating the anonymity layer that ECH provides. This is particularly problematic in scenarios where clients are expected to maintain unlinkability across separate TLS connections—such as privacy-focused browsers, VPN clients, or privacy-respecting APIs. The flaw requires no active participation or elevated privileges; passive observation is sufficient.

Business impact

Organizations deploying Go-based TLS servers or clients that rely on ECH for privacy assurances should recognize that current versions leak sufficient information for traffic analysis. This is most critical for entities handling sensitive communications where client anonymity or session unlinkability is a business or compliance requirement: privacy-centric applications, financial services, health-tech platforms, and censorship-circumvention tools. The vulnerability does not lead to data exfiltration, code execution, or denial of service, but it does erode trust in privacy guarantees and may expose business logic (e.g., which clients frequently reconnect, behavioral patterns). For organizations not explicitly relying on ECH for privacy, the impact is negligible. However, as ECH adoption increases and becomes a default privacy mechanism, this gap creates a silent compliance or trust liability.

Affected systems

The vulnerability is specific to Go's cryptography and TLS implementation (golang/go). Organizations should audit all services written in Go that enable or negotiate Encrypted Client Hello. This includes Go-based proxies, API gateways, web services, or client libraries that support ECH. The flaw does not affect other languages or TLS libraries unless they have independently replicated the same implementation error. Check the golang security advisory for the exact affected versions; typically Go patch releases in the 1.x line will be addressed in sequence.

Exploitability

Exploitation requires no authentication, user interaction, or special network position beyond passive observation of network traffic. An attacker on the network path (ISP, corporate network, WiFi network, or anyone with tcpdump-level visibility) can extract and correlate PSK identities. The barrier to exploitation is purely technical: the attacker must be able to passively capture traffic and parse TLS frames. This makes the vulnerability exploitable in high-confidence network scenarios (mobile networks, shared WiFi, transit networks, state-level surveillance). However, the attack does not yield immediate tactical data theft; it is a privacy and fingerprinting threat. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that network access and low attack complexity are all that is required.

Remediation

Apply the patched version of Go released to fix CVE-2026-42505. Verify the exact patch version against the official Go security advisories (golang.org/security). Recompile and redeploy all Go-based services that handle TLS. For clients, update to the fixed Go runtime version. Until patched, organizations can reduce exposure by disabling Encrypted Client Hello if it is not operationally necessary, though this reintroduces cleartext ClientHello leakage and is a trade-off decision. No workarounds exist at the application layer once Go's TLS library is in use.

Patch guidance

1. Monitor the official Go security advisories at golang.org/security for the release notes and patch versions for CVE-2026-42505. 2. Identify all Go services in your environment (via build metadata, SBOM, or dependency scanning). 3. Update Go to the patched version; verify compatibility with your service's Go version constraint (go.mod). 4. Recompile and test in a staging environment to ensure no regressions. 5. Deploy in a coordinated rollout to minimize service interruption. 6. Confirm that no custom TLS implementations or middleboxes are interfering with the patched behavior.

Detection guidance

Detection is difficult because the flaw is in the TLS handshake and does not generate anomalous logs in application or system logs. Network-based detection: Organizations with network monitoring capabilities can use tools like Zeek, Suricata, or packet analysis to identify instances where PSK identities are transmitted in the unencrypted ClientHello when ECH is negotiated. However, this is a configuration and deep-packet inspection problem, not an intrusion signal. Application-level logging: Ensure Go TLS configuration logging is enabled; check for warnings or debug logs indicating ECH negotiation with PSK resumption. Host-based detection: Monitor for unexpected library version downgrades or disablement of ECH as a compensating control. The best approach is proactive: validate that all Go services have been patched and that ECH negotiation is working as intended in the fixed version.

Why prioritize this

Although the CVSS score is 5.3 (Medium), prioritization depends on operational context. If your organization does not use ECH or does not rely on client anonymity/unlinkability guarantees, this is a lower priority. However, if you operate privacy-centric services, handle sensitive communications, or have compliance obligations around anonymity (GDPR, privacy regulations), this should be patched promptly. The lack of KEV (Known Exploited Vulnerability) status does not indicate low risk; it reflects the nascency of the vulnerability and limited public exploitation reports so far. Passive traffic analysis attacks are harder to detect and attribute, so active exploitation may be underreported. Organizations in regulated industries or high-threat environments should prioritize patching within 30 days; others can include it in standard quarterly patching cycles.

Risk score, explained

The CVSS 5.3 score reflects low-to-medium impact: there is confidentiality loss (C:L) through information disclosure, but no integrity or availability impact. The vector AV:N/AC:L/PR:N/UI:N indicates wide accessibility. However, the real-world risk is context-dependent. For a privacy-centric service or one handling sensitive communications, the impact of de-anonymization can be severe (raising effective risk closer to High). For standard enterprise services where client anonymity is not a threat model, the practical risk is negligible. Additionally, the attack requires sustained passive observation and offline analysis of traffic patterns—it is not a real-time attack. Organizations should layer this CVSS assessment with their own threat model and privacy commitments when determining patch priority.

Frequently asked questions