oss-security - CVE-2025-68121: Regression and Incomplete Fix for Go TLS Session Resumption

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALj3r0jnYcmJ9-ymGs1X3_t7=9OV6UbvVJ7nmiuXpfe+9yN9Tg@mail.gmail.com>
Date: Sun, 18 Jan 2026 00:20:04 +0800
From: Coia Prant <coiaprant@...il.com>
To: oss-security@...ts.openwall.com, security@...e.com, 
	team@...urity.debian.org, secalert@...hat.com
Subject: CVE-2025-68121: Regression and Incomplete Fix for Go TLS Session Resumption

Hi,

I am the original reporter of the vulnerabilities recently addressed
in Go 1.25.6/1.24.x (CVE-2025-61730, CVE-2025-68121).

I am writing to inform the community that the official fix provided by
the Go security team is critically flawed and causes significant
regressions in the networking ecosystem (notably breaking quic-go).

1. Missing Root Cause in Official Advisory

The official advisory attributes the risk to "misuse of APIs," but the
root cause is a fundamental logic error in Go's TLS 1.3 state machine
during session resumption.

Specifically, it fails to re-validate the identity of the trust anchor
when a session is resumed, allowing for Cross-CA certificate bypass.

2. Flawed Patch Implementation

The current official patch (CL 735051) contains amateurish errors that
undermine its effectiveness:

Incorrect Indexing: It attempts to verify peerCertificates instead of
the verifiedChain (that include RootCA).

Ecosystem Breakage: By aggressively blocking Config.Clone logic to
"fix" the issue, it has paralyzed 0-RTT and session resumption in the
QUIC ecosystem.

3. Proposed O(1) Solution

I have proposed a far more elegant solution that performs a
constant-time SHA-224 fingerprint check of the root CA.

This fixes the vulnerability without breaking the Config.Clone
semantics or performance.

Details and Discussion:

https://github.com/golang/go/issues/77217

I encourage downstream maintainers (SUSE, Red Hat, Debian) to review
the fix before deploying it to mission-critical infrastructure.

Best regards,
Coia Prant (rbqvq)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.