crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🗓️ 09 Mar 2026 01:52:37Reported by RedHatType

Mutating client authorities or root authorities between initial and resumed handshakes can cause unexpected TLS session resumption.

Reporter	Title	Published	Views	Family All 1906
FreeBSD	oauth2-proxy -- multiple vulnerabilities	5 Feb 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to loss of confidentiality (CVE-2025-68121)	31 Mar 202615:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	10 Mar 202612:40	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to handshake corruption due to the crypto/tls package (CVE-2025-68121)	24 Mar 202614:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud multiple vulnerabilities addressed	17 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	14 Apr 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	20 May 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Certificate Validation in crypto/tls [CVE-2025-68121]	14 Apr 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 2 of 2)	4 May 202618:40	–	ibm
ATTACKERKB	CVE-2025-68121	5 Feb 202617:48	–	attackerkb

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.0	aarch64	golang-github-openprinting-ipp-usb-debugsource	0.9.27-3.el10_0.2	golang-github-openprinting-ipp-usb-debugsource-0.9.27-3.el10_0.2.aarch64.rpm
Red Hat Enterprise Linux	10.0	ppc64le	golang-github-openprinting-ipp-usb-debugsource	0.9.27-3.el10_0.2	golang-github-openprinting-ipp-usb-debugsource-0.9.27-3.el10_0.2.ppc64le.rpm
Red Hat Enterprise Linux	10.0	s390x	golang-github-openprinting-ipp-usb-debugsource	0.9.27-3.el10_0.2	golang-github-openprinting-ipp-usb-debugsource-0.9.27-3.el10_0.2.s390x.rpm
Red Hat Enterprise Linux	10.0	x86_64	golang-github-openprinting-ipp-usb-debugsource	0.9.27-3.el10_0.2	golang-github-openprinting-ipp-usb-debugsource-0.9.27-3.el10_0.2.x86_64.rpm
Red Hat Enterprise Linux	10.0	aarch64	ipp-usb	0.9.27-3.el10_0.2	ipp-usb-0.9.27-3.el10_0.2.aarch64.rpm
Red Hat Enterprise Linux	10.0	ppc64le	ipp-usb	0.9.27-3.el10_0.2	ipp-usb-0.9.27-3.el10_0.2.ppc64le.rpm
Red Hat Enterprise Linux	10.0	s390x	ipp-usb	0.9.27-3.el10_0.2	ipp-usb-0.9.27-3.el10_0.2.s390x.rpm
Red Hat Enterprise Linux	10.0	x86_64	ipp-usb	0.9.27-3.el10_0.2	ipp-usb-0.9.27-3.el10_0.2.x86_64.rpm
Red Hat Enterprise Linux	10.0	aarch64	ipp-usb-debuginfo	0.9.27-3.el10_0.2	ipp-usb-debuginfo-0.9.27-3.el10_0.2.aarch64.rpm
Red Hat Enterprise Linux	10.0	ppc64le	ipp-usb-debuginfo	0.9.27-3.el10_0.2	ipp-usb-debuginfo-0.9.27-3.el10_0.2.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-68121
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/737700
go	www.go.dev/issue/77217
groups	www.groups.google.com/g/golang-announce/c/K09ubi9FQFk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-68121
pkg	www.pkg.go.dev/vuln/GO-2026-4337
cve	www.cve.org/CVERecord

24 Jul 2026 05:56Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.1 - 10

EPSS0.00765

SSVC