CVE catalog

CVE-2025-54799

golang-github-xenolf-lego: CVE-2025-54799

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-xenolf-legosid4.35.2-3fixed
Debiangolang-github-xenolf-legoforky4.35.2-3fixed
Debiangolang-github-xenolf-legotrixie4.9.1-2vulnerable
Debiangolang-github-xenolf-legobookworm4.9.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-xenolf-legosourcesid4.35.2-1not yet assignedNot reported[1110531]
Debiangolang-github-xenolf-legosourceforky4.35.2-1not yet assignedNot reported[1110531]
Debiangolang-github-xenolf-legosourcetrixie(unfixed)not yet assignedNot reported[1110531]
Debiangolang-github-xenolf-legosourcebookworm(unfixed)not yet assignedNot reported[1110531]

[Debian bug #1110531]

Notes

[trixie] golang-github-xenolf-lego: Minor issue [bookworm] golang-github-xenolf-lego: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-xenolf-lego-dev]Affected

    Source package: [golang-github-xenolf-lego]

    Details (2)

    • 4.9.1-1 · all · bookworm

      Affected

      dsa · golang-github-xenolf-lego · debian · bookworm; dsa · golang-github-xenolf-lego · debian · 12

    • 4.9.1-1 · all · bookworm

      Affected

      dsa · golang-github-xenolf-lego · debian · bookworm; dsa · golang-github-xenolf-lego · debian · 12

  • [lego]Affected

    Source package: [golang-github-xenolf-lego]

    Details (2)

    • 4.9.1-1 · amd64 · bookworm

      Affected

      dsa · golang-github-xenolf-lego · debian · bookworm; dsa · golang-github-xenolf-lego · debian · 12

    • 4.9.1-1 · arm64 · bookworm

      Affected

      dsa · golang-github-xenolf-lego · debian · bookworm; dsa · golang-github-xenolf-lego · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-xenolf-lego-dev]Affected

    Source package: [golang-github-xenolf-lego]

    Details (4)

    • 4.9.1-2 · all · trixie

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

    • 4.9.1-2 · all · trixie

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

    • 4.35.2-3~bpo13+1 · all · trixie-backports

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

    • 4.35.2-3~bpo13+1 · all · trixie-backports

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

  • [lego]Affected

    Source package: [golang-github-xenolf-lego]

    Details (4)

    • 4.9.1-2 · amd64 · trixie

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

    • 4.9.1-2 · arm64 · trixie

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

    • 4.35.2-3~bpo13+1 · amd64 · trixie-backports

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

    • 4.35.2-3~bpo13+1 · arm64 · trixie-backports

      Affected

      dsa · golang-github-xenolf-lego · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]