This vulnerability arises from improper validation of certificates during TLS session resumption in Go's crypto/tls library. Specifically, if the TLS Config's ClientCAs or RootCAs fields are changed after the initial handshake but before resumption, the resumed handshake may incorrectly succeed. This is due to the resumed handshake relying on the mutated Config rather than the original validation context. The issue affects Go versions prior to 1.26.0-rc.1 and can lead to resumed sessions with entities that would have been rejected initially, violating expected authentication constraints. The CVSS v3.1 score is 9.1 (critical) with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

The vulnerability can allow an attacker to bypass intended certificate validation during TLS session resumption, potentially enabling unauthorized session resumption with a client or server that would have been rejected during the initial handshake. This undermines the security guarantees of TLS authentication, risking confidentiality and integrity of communications. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided in the current data. Users should monitor official Go project advisories for updates and avoid mutating Config.ClientCAs or Config.RootCAs between handshakes as a temporary mitigation if possible.