Vulnerability in Go-acme Lego
CVE-2025-54799
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME c…
EPSS: 0.002 (11.8th percentile) — read the EPSS interpretation.
Affected products
- Go-acme Lego — versions < 4.25.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)