The golang-1.10 package in Ubuntu contains a vulnerability where handshakes that use Encrypted Client Hello (ECH) can be de-anonymized by a passive network observer. This occurs because pre-shared key (PSK) identities are disclosed in the unencrypted client hello message, revealing information that should remain confidential. The vulnerability affects numerous Ubuntu versions from 14.04 LTS through 26.04 LTS and standard releases. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and a low confidentiality impact without integrity or availability impact. There is no information on available patches or fixes in the provided data.

The vulnerability allows a passive network attacker to gain limited confidentiality information by de-anonymizing TLS handshakes that use Encrypted Client Hello. This disclosure of pre-shared key identities could potentially reveal user or session information but does not affect integrity or availability. There are no known exploits in the wild reported. The impact is limited to confidentiality with no direct impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Ubuntu security advisories for updates addressing this issue. No vendor advisory states that no action is required or that the issue is already mitigated.