Race condition in Go programming language - CVE-2025-61730

Vulnerability identifier: #VU124038

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2025-61730

CWE-ID: CWE-362

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to a race condition when handling multiple messages during TLS 1.3 handshake. A remote attacker with ability to inject messages during the handshake can gain access to sensitive information. 

Go programming language
Guardium Data Security Center (GDSC)
Dell EMC OpenManage Enterprise Modular
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Business Automation Workflow
iDRAC10
Splunk Operator for Kubernetes Add-on

Install updates from vendor's website.

Go programming language - addressed in versions 1.24.12, 1.25.6
Guardium Data Security Center (GDSC) - update to 3.8.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 2
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
iDRAC10 - addressed in versions 1.30.10.50, 1.30.10.51
Dell EMC OpenManage Enterprise Modular - update to 2.20.20
Splunk Operator for Kubernetes Add-on - update to 3.1.0

• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• https://github.com/golang/go/issues/76443

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM Watson Speech Services Cartridge update for crypto/tls
• Splunk Operator for Kubernetes Add-on update for third-party components
• Multiple vulnerabilities in Dell iDRAC10
• Multiple vulnerabilities in Dell OpenManage Enterprise Modular
• Multiple vulnerabilities in IBM Business Automation Workflow