helper binary flagged for CVE-2025-68121 (go/stdlib crypto/tls)

[tmiyako-cod]

Summary

The helper binary included in the built image (/layers/paketo-buildpacks_ca-certificates/helper/helper) is flagged for CVE-2025-68121 (go/stdlib crypto/tls) by AWS ECR image scanning.

Details

• CVE: CVE-2025-68121
• Affected component: crypto/tls - TLS session resumption certificate validation bypass
• Fixed in Go versions: 1.24.13, 1.25.7, 1.26.0-rc.3
• Detected path in image: /layers/paketo-buildpacks_ca-certificates/helper/helper

Environment

• ca-certificates buildpack: v3.11.1
• Builder: paketobuildpacks/builder-jammy-base:latest
• Build tool: Spring Boot BootBuildImage

Expected behavior

The helper binary should be compiled with Go 1.25.7+ (or 1.24.13+) to resolve CVE-2025-68121.

Notes

Go 1.25.7 was released on 2026-02-04, and ca-certificates v3.11.1 was released on 2026-02-06. However, the v3.11.1 release only included "Bump Go Modules" and the helper binary appears to still be built with a Go version prior to 1.25.7, as the CVE is still reported in scans.

In https://github.com/orgs/paketo-buildpacks/discussions/308, a maintainer mentioned:

Our system automatically updates and pulls the latest patch releases of Go when we build

Could a new patch release be published with an updated Go toolchain?

Thank you for maintaining this project!

[dmikusa]

The helper binary would have been built with the latest go version available at the time. We can certainly plan for another release to update again. I should be able to do that Friday.

This wouldn't be the first time that a go issue has been released right after we update 🥲

[tmiyako-cod]

Thank you so much for the quick response! Friday sounds great.
And yes, it seems like Go security releases have a talent for landing right after your updates 😄

[dmikusa]

Releases cut today:

• https://github.com/paketo-buildpacks/java/releases/tag/v21.2.0
• https://github.com/paketo-buildpacks/java-native-image/releases/tag/v14.1.0

[tmiyako-cod]

Thank you for the quick turnaround! I've confirmed that the vulnerability (CVE-2025-68121) is no longer flagged in our image scans after rebuilding with the updated buildpacks. Closing this discussion.