crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🗓️ 02 Jun 2026 11:22:13Reported by RedHatType

redhat🔗 access.redhat.com👁 15 Views

Flaw in Transport Layer Security resumption allows certificate validation bypass if authority settings change.

Reporter	Title	Published	Views	Family All 2089
RedhatCVE	CVE-2025-68121	12 Feb 202611:01	–	redhatcve
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update	9 Apr 202611:00	–	redhat
RedHat Linux	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption	9 Apr 202611:00	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update	10 Apr 202614:24	–	redhat
RedHat Linux	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption	10 Apr 202614:24	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: podman security update	13 Apr 202612:51	–	redhat
RedHat Linux	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption	13 Apr 202612:51	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0.18 (golang-github-openstack-k8s-operators-os-diff) security update	29 Apr 202604:17	–	redhat
RedHat Linux	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption	29 Apr 202604:17	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Submariner v0.22 security fixes and container updates	14 Apr 202615:55	–	redhat

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.2	aarch64	osbuild-composer	165.1-2.el10_2	osbuild-composer-165.1-2.el10_2.aarch64.rpm
Red Hat Enterprise Linux	10.2	ppc64le	osbuild-composer	165.1-2.el10_2	osbuild-composer-165.1-2.el10_2.ppc64le.rpm
Red Hat Enterprise Linux	10.2	s390x	osbuild-composer	165.1-2.el10_2	osbuild-composer-165.1-2.el10_2.s390x.rpm
Red Hat Enterprise Linux	10.2	x86_64	osbuild-composer	165.1-2.el10_2	osbuild-composer-165.1-2.el10_2.x86_64.rpm
Red Hat Enterprise Linux	10.2	aarch64	osbuild-composer-core	165.1-2.el10_2	osbuild-composer-core-165.1-2.el10_2.aarch64.rpm
Red Hat Enterprise Linux	10.2	ppc64le	osbuild-composer-core	165.1-2.el10_2	osbuild-composer-core-165.1-2.el10_2.ppc64le.rpm
Red Hat Enterprise Linux	10.2	s390x	osbuild-composer-core	165.1-2.el10_2	osbuild-composer-core-165.1-2.el10_2.s390x.rpm
Red Hat Enterprise Linux	10.2	x86_64	osbuild-composer-core	165.1-2.el10_2	osbuild-composer-core-165.1-2.el10_2.x86_64.rpm
Red Hat Enterprise Linux	10.2	aarch64	osbuild-composer-core-debuginfo	165.1-2.el10_2	osbuild-composer-core-debuginfo-165.1-2.el10_2.aarch64.rpm
Red Hat Enterprise Linux	10.2	ppc64le	osbuild-composer-core-debuginfo	165.1-2.el10_2	osbuild-composer-core-debuginfo-165.1-2.el10_2.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-68121
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/737700
go	www.go.dev/issue/77217
groups	www.groups.google.com/g/golang-announce/c/K09ubi9FQFk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-68121
pkg	www.pkg.go.dev/vuln/GO-2026-4337
cve	www.cve.org/CVERecord

22 Aug 2026 02:40Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1 - 10

EPSS0.00765

SSVC

Transport Layer Security Certificate validation Resumption Certificate authority settings Authentication bypass Handshake changes Unix