When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. We expect most logging software filters control characters and such, so the impact for this is relatively limited, hence we are treating this as a PUBLIC track issue, per the Go Security Policy (https://go.dev/security/policy).

This is CVE-2025-58189.