VDB

GO-2025-3847

GO-2025-3847 PUBLISHED CVSS 9.300000190734863 CRITICAL

Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego

Risk Scores

CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
chainguardterraform-provider-acme0, 0
chainguardtraefik-fips-3.50, 0
wolfiterraform-provider-acme0, 0, 0
chainguardtraefik-3.40, 0
chainguardtraefik-fips-2.110, 0
wolfisftpgo0, 0, 0
chainguardsftpgo0, 0
chainguardtraefik-2.110, 0
chainguardterraform-provider-acme-fips0, 0
wolfitraefik-3.30, 0, 0
github.comgo-acme/lego/v40, 0
chainguardtraefik-3.30, 0
wolfitraefik-3.40, 0, 0
chainguardtraefik-3.50, 0

Timeline

  • Aug 11, 2025 CVE Published
  • Feb 4, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›