CVE-2026-42505: Encrypted Client Hello Info Disclosure

CVE-2026-42505 Overview

CVE-2026-42505 is an information disclosure vulnerability affecting Go's Transport Layer Security (TLS) implementation. The flaw allows a passive network observer to de-anonymize handshakes that use Encrypted Client Hello (ECH). The unencrypted outer ClientHello leaks pre-shared key (PSK) identities that should have remained confidential. This breaks the anonymity guarantee that ECH is designed to provide. The issue is tracked in the Go vulnerability database as GO-2026-5856 and is mapped to [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
A passive on-path observer can correlate TLS sessions and identify clients despite ECH being enabled, undermining the privacy properties of the handshake.

Affected Products

Go standard library crypto/tls package with ECH support
Applications built with affected Go versions that enable Encrypted Client Hello
See the Go.dev Vulnerability Report for version specifics

Discovery Timeline

2026-07-08 - CVE-2026-42505 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-42505

Vulnerability Analysis

Encrypted Client Hello (ECH) is a TLS 1.3 extension that encrypts sensitive ClientHello fields, including the Server Name Indication (SNI), inside an inner ClientHello. The outer ClientHello is meant to carry only generic or decoy values. This protects client identity and destination from passive observers.

The Go implementation placed pre-shared key (PSK) identities in the unencrypted outer ClientHello. PSK identities are per-client or per-session values used to resume TLS sessions or authenticate with a known key. Because these identifiers appeared in the outer handshake, an observer could read them directly from network traffic. The confidentiality impact is limited to disclosure. Integrity and availability are not affected.

Root Cause

The vulnerability stems from improper separation between the inner and outer ClientHello messages. PSK extension data, which links a session to a specific client or prior connection, was serialized into the outer handshake rather than kept exclusively inside the encrypted inner ClientHello. This constitutes an information exposure through sent data pattern described by [CWE-201].

Attack Vector

Exploitation is fully passive. An attacker with visibility into network traffic between the client and server observes the outer ClientHello and extracts the PSK identity value. The attacker can then correlate handshakes across sessions, link a client to prior sessions, or fingerprint users on a network. No interaction with the client or server is required, and no privileges are needed. The attack does not decrypt application data but defeats the anonymity that ECH is expected to guarantee.

Technical background is available in the Go.dev Issue Discussion and the corresponding Go.dev Code Change.

Detection Methods for CVE-2026-42505

Indicators of Compromise

Presence of populated PSK identity extensions in outer ClientHello messages when ECH is negotiated
Recurring PSK identity values observed across TLS sessions from the same client to different apparent destinations
Go-based TLS clients running versions prior to the fix referenced in GO-2026-5856

Detection Strategies

Inspect TLS handshake captures with tools such as Wireshark to verify that outer ClientHello messages do not contain client-identifying PSK extension data.
Inventory Go binaries in the environment and compare their embedded Go runtime version against the fixed release listed in the Golang Announce Update.
Add build-time checks in CI pipelines to fail builds that depend on vulnerable Go toolchain versions.

Monitoring Recommendations

Monitor egress TLS traffic for repeated PSK identity values that could enable client correlation.
Track deployment of Go runtime updates across services that terminate or initiate TLS with ECH.
Alert on outbound connections from services still linked against unpatched Go versions once inventory is complete.

How to Mitigate CVE-2026-42505

Immediate Actions Required

Upgrade the Go toolchain to the patched version identified in the Golang Announce Update and rebuild affected binaries.
Identify all services that enable ECH in crypto/tls and prioritize their rebuild and redeployment.
If ECH was enabled specifically for privacy guarantees, treat prior sessions as potentially correlated by observers.

Patch Information

The fix is delivered through the Go standard library update referenced in Go.dev Code Change CL/775960. The patch ensures PSK identities are placed in the encrypted inner ClientHello rather than the outer message. Consult the Go.dev Vulnerability Report for the exact fixed versions and apply the update to all Go builds.

Workarounds

Disable Encrypted Client Hello in affected services until the Go runtime is upgraded, since ECH provides no anonymity benefit while this flaw is present.
Disable TLS session resumption via PSK for services where client-linkability is a concern, removing the identifier that leaks.
Route sensitive client traffic through a patched TLS-terminating proxy while Go-based components are being rebuilt.

bash

# Verify Go toolchain version and rebuild after upgrade
go version
go install golang.org/dl/go<fixed-version>@latest
go<fixed-version> download
go<fixed-version> build ./...