CVE-2026-42505 is a vulnerability in the Go standard library's crypto/tls package where handshakes that use Encrypted Client Hello can be de-anonymized by a passive network observer. This occurs because pre-shared key (PSK) identities are disclosed in the unencrypted client hello message, leaking sensitive information that compromises anonymity. The affected versions include exactly 1.26.0-0, 1.27.0-0, all versions prior to 1.25.12, and versions from 1.26.0-0 up to but excluding 1.26.5. There is no CVSS score or vendor advisory indicating a patch or mitigation at this time.

The vulnerability allows passive network observers to gain sensitive information about pre-shared key identities during TLS handshakes that use Encrypted Client Hello. This can lead to de-anonymization of clients, potentially exposing user privacy and undermining the confidentiality guarantees of the handshake process. There is no indication of active exploitation in the wild or further impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding affected versions or disabling Encrypted Client Hello if feasible. Monitor official Go project communications for updates on patches or mitigations.