go-acme lego up to 4.25.1 ACME Protocol api cleartext transmission

Summaryinfo

A vulnerability marked as problematic has been reported in go-acme lego up to 4.25.1. This vulnerability affects unknown code of the file github.com/go-acme/lego/v4/acme/api of the component ACME Protocol Handler. Performing a manipulation results in cleartext transmission. This vulnerability was named CVE-2025-54799. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in go-acme lego up to 4.25.1. This affects an unknown code of the file github.com/go-acme/lego/v4/acme/api of the component ACME Protocol Handler. The manipulation with an unknown input leads to a cleartext transmission vulnerability. CWE is classifying the issue as CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. This is going to have an impact on confidentiality. The summary by CVE is:

Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-54799 since 07/29/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1040 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 253527 (Linux Distros Unpatched Vulnerability : CVE-2025-54799), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.25.2 eliminates this vulnerability. Applying the patch 238454b5f74f3cfcbb244ff0d0dc914a4ad44b96 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (253527). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• go-acme

Name

• lego

Version

• 4.25.0
• 4.25.1

License

• open-source

Website

• Product: https://github.com/go-acme/lego/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion