{"id":"EUVD-2026-42317","revision":"90131c20b7a64df6bef5f54e21cbb7c4","records":[{"revision":"90131c20b7a64df6bef5f54e21cbb7c4","observedAt":"2026-11-05T09:03:08.578+00:00","statement":{"source":"euvd","id":"EUVD-2026-42317","aliases":["CVE-2026-42505","GHSA-ff52-ph69-cf7x"],"title":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":["https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-5856"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42317","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 3:46:33 PM","dateUpdated":"Jul 8, 2026, 7:38:17 PM"},"relatedAdvisories":[{"id":"RHSA-2026:91249","title":"Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)","vulnerabilityIds":["CVE-2025-69418","CVE-2026-6653","CVE-2026-11979","CVE-2026-13346","CVE-2026-25679","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27145","CVE-2026-28390","CVE-2026-31790","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-34182","CVE-2026-34183","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42502","CVE-2026-42504","CVE-2026-42505","CVE-2026-42506","CVE-2026-42507","CVE-2026-45445","CVE-2026-45447","CVE-2026-74860","CVE-2026-86138","CVE-2026-86140","CVE-2026-86142","CVE-2026-86143","CVE-2026-86144","CVE-2026-86145","CVE-2026-89090","CVE-2026-89161","CVE-2026-103111","CVE-2026-114406"]},{"id":"WID-SEC-W-2026-2239","title":"Golang Go: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"SUSE-SU-2026:22641-1","title":"Security update for go1.26-openssl","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"msrc_CVE-2026-42505","title":"Invoking Encrypted Client Hello privacy leak in crypto/tls","vulnerabilityIds":["CVE-2026-42505"]},{"id":"openSUSE-SU-2026:21321-1","title":"Security update for go1.26-openssl","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"openSUSE-SU-2026:21341-1","title":"Security update for go1.26","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"RHSA-2026:36510","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"openSUSE-SU-2026:11232-1","title":"go1.26-1.26.5-1.1 on GA media","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"openSUSE-SU-2026:11471-1","title":"tekton-cli-0.46.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-42505"]},{"id":"RHSA-2026:37436","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-39821","CVE-2026-39822","CVE-2026-42505"]},{"id":"SUSE-SU-2026:22643-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2026-25679","CVE-2026-27139","CVE-2026-27142","CVE-2026-39822","CVE-2026-42505"]},{"id":"openSUSE-SU-2026:11216-1","title":"mihomo-1.19.28-1.1 on GA media","vulnerabilityIds":["CVE-2026-42505"]},{"id":"SUSE-SU-2026:22656-1","title":"Security update for go1.26","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"RHSA-2026:36477","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"SUSE-SU-2026:22638-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-61732","CVE-2025-68121","CVE-2026-25679","CVE-2026-27139","CVE-2026-27140","CVE-2026-27142","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501","CVE-2026-42504","CVE-2026-42505","CVE-2026-42507"]},{"id":"RHSA-2026:54773","title":"Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.2 release","vulnerabilityIds":["CVE-2026-39822","CVE-2026-41178","CVE-2026-42505","CVE-2026-46600","CVE-2026-56852"]},{"id":"openSUSE-SU-2026:11798-1","title":"go-passbolt-cli-0.5.2-1.1 on GA media","vulnerabilityIds":["CVE-2026-42505"]},{"id":"RHSA-2026:37435","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-39821","CVE-2026-39822","CVE-2026-42505"]},{"id":"RHSA-2026:91248","title":"Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)","vulnerabilityIds":["CVE-2025-69418","CVE-2026-6653","CVE-2026-11979","CVE-2026-13346","CVE-2026-25679","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27145","CVE-2026-28390","CVE-2026-31790","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-34182","CVE-2026-34183","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42502","CVE-2026-42504","CVE-2026-42505","CVE-2026-42506","CVE-2026-42507","CVE-2026-44172","CVE-2026-45445","CVE-2026-45447","CVE-2026-74860","CVE-2026-86138","CVE-2026-86140","CVE-2026-86142","CVE-2026-86143","CVE-2026-86144","CVE-2026-86145","CVE-2026-89090","CVE-2026-89161","CVE-2026-103111","CVE-2026-114406"]},{"id":"RHSA-2026:66364","title":"Red Hat Security Advisory: git-lfs security update","vulnerabilityIds":["CVE-2026-33818","CVE-2026-42505","CVE-2026-42507","CVE-2026-56860","CVE-2026-56862"]},{"id":"openSUSE-SU-2026:21319-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-61732","CVE-2025-68121","CVE-2026-25679","CVE-2026-27139","CVE-2026-27140","CVE-2026-27142","CVE-2026-27143","CVE-2026-27144","CVE-2026-27145","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33811","CVE-2026-33814","CVE-2026-39817","CVE-2026-39819","CVE-2026-39820","CVE-2026-39822","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39836","CVE-2026-42499","CVE-2026-42501","CVE-2026-42504","CVE-2026-42505","CVE-2026-42507"]},{"id":"openSUSE-SU-2026:11212-1","title":"go1.25-1.25.12-1.1 on GA media","vulnerabilityIds":["CVE-2026-39822","CVE-2026-42505"]},{"id":"RHSA-2026:38995","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-39821","CVE-2026-39822","CVE-2026-42504","CVE-2026-42505","CVE-2026-42507"]},{"id":"openSUSE-SU-2026:21324-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2026-25679","CVE-2026-27139","CVE-2026-27142","CVE-2026-39822","CVE-2026-42505"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42317","identifiers":["EUVD-2026-42317","CVE-2026-42505","GHSA-ff52-ph69-cf7x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}