Google: dev-lang/go: security update to 18867.381.24

critical Tenable Self-Hosted Container Security Plugin ID 453037

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields
mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it
should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or
uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would
not have resumed with during the initial handshake, or cause a server to resume a session with a client
that it would not have resumed with during the initial handshake. (CVE-2025-68121)

Solution

Update the dev-lang/go library and its related packages to version 18867.381.24 or later.

Plugin Details

Severity: Critical

ID: 453037

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.16

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-68121

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/22/2026

Reference Information

CVE: CVE-2025-68121

Detections

Analytics