{"cve":"CVE-2025-54799","nvd":{"published":"2025-08-07T01:15:26.370","modified":"2026-06-17T09:40:43.547","status":"Deferred","description":"Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","score":2.3},"cvss_v3":null,"cwes":["CWE-319"],"references":["https://github.com/go-acme/lego/commit/238454b5f74f3cfcbb244ff0d0dc914a4ad44b96","https://github.com/go-acme/lego/security/advisories/GHSA-q82r-2j7m-9rv4"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:06:45.861874017+00:00"},"epss":{"cve":"CVE-2025-54799","score":0.00238,"percentile":0.14912,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-q82r-2j7m-9rv4","url":"https://osv.dev/vulnerability/GHSA-q82r-2j7m-9rv4","summary":"github.com/go-acme/lego/v4/acme/api does not enforce HTTPS","modified":"2026-09-10T03:50:27.302884949Z","packages":[{"ecosystem":"Go","name":"github.com/go-acme/lego","purl":"pkg:golang/github.com/go-acme/lego","ranges":["<=4.25.1"],"fixed":[]},{"ecosystem":"Go","name":"github.com/go-acme/lego/v3","purl":"pkg:golang/github.com/go-acme/lego/v3","ranges":["<=4.25.1"],"fixed":[]},{"ecosystem":"Go","name":"github.com/go-acme/lego/v4","purl":"pkg:golang/github.com/go-acme/lego/v4","ranges":["<4.25.2"],"fixed":["4.25.2"]}]},{"id":"GO-2025-3847","url":"https://osv.dev/vulnerability/GO-2025-3847","summary":"Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego","modified":"2026-02-04T04:28:55.836126Z","packages":[{"ecosystem":"Go","name":"github.com/go-acme/lego/v4","purl":"pkg:golang/github.com/go-acme/lego/v4","ranges":["<4.25.2"],"fixed":["4.25.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}