Skip to content
OpenAdvisories

Package · Go

github.com/go-acme/lego/v4

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.3
    CVE-2025-54799

    Lego does not enforce HTTPS

    Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the ht…

    go-acme lego sftpgo terraform-provider-acme Debian Ubuntu Wolfi Go