crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🗓️ 29 Jul 2026 21:52:07Reported by RedHatType

A flaw in the crypto/tls component allows certificate validation bypass during TLS session resumption when CA settings change between handshakes.

Reporter	Title	Published	Views	Family All 1000
FreeBSD	oauth2-proxy -- multiple vulnerabilities	5 Feb 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to loss of confidentiality (CVE-2025-68121)	31 Mar 202615:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	10 Mar 202612:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	27 Aug 202619:23	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Crypto affects IBM Netezza Appliance	10 Aug 202608:57	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to handshake corruption due to the crypto/tls package (CVE-2025-68121)	24 Mar 202614:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud multiple vulnerabilities addressed	17 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	14 Apr 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	20 May 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Certificate Validation in crypto/tls [CVE-2025-68121]	14 Apr 202615:34	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9.2	aarch64	grafana	9.0.9-12.el9_2	grafana-9.0.9-12.el9_2.aarch64.rpm
Red Hat Enterprise Linux	9.2	ppc64le	grafana	9.0.9-12.el9_2	grafana-9.0.9-12.el9_2.ppc64le.rpm
Red Hat Enterprise Linux	9.2	s390x	grafana	9.0.9-12.el9_2	grafana-9.0.9-12.el9_2.s390x.rpm
Red Hat Enterprise Linux	9.2	x86_64	grafana	9.0.9-12.el9_2	grafana-9.0.9-12.el9_2.x86_64.rpm
Red Hat Enterprise Linux	9.2	aarch64	grafana-debuginfo	9.0.9-12.el9_2	grafana-debuginfo-9.0.9-12.el9_2.aarch64.rpm
Red Hat Enterprise Linux	9.2	ppc64le	grafana-debuginfo	9.0.9-12.el9_2	grafana-debuginfo-9.0.9-12.el9_2.ppc64le.rpm
Red Hat Enterprise Linux	9.2	s390x	grafana-debuginfo	9.0.9-12.el9_2	grafana-debuginfo-9.0.9-12.el9_2.s390x.rpm
Red Hat Enterprise Linux	9.2	x86_64	grafana-debuginfo	9.0.9-12.el9_2	grafana-debuginfo-9.0.9-12.el9_2.x86_64.rpm
Red Hat Enterprise Linux	9.2	aarch64	grafana-debugsource	9.0.9-12.el9_2	grafana-debugsource-9.0.9-12.el9_2.aarch64.rpm
Red Hat Enterprise Linux	9.2	ppc64le	grafana-debugsource	9.0.9-12.el9_2	grafana-debugsource-9.0.9-12.el9_2.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-68121
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/737700
go	www.go.dev/issue/77217
groups	www.groups.google.com/g/golang-announce/c/K09ubi9FQFk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-68121
pkg	www.pkg.go.dev/vuln/GO-2026-4337
cve	www.cve.org/CVERecord

30 Sep 2026 09:16Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.1 - 10

EPSS0.00856

SSVC

CWE-295