CVE-2025-54799: github.com/go-acme/lego/v4/acme/api does not enforce HTTPS

August 6, 2025 (updated November 10, 2025)

It was discovered that the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don’t enforce HTTPS when talking to CAs as an ACME client.

References

github.com/advisories/GHSA-q82r-2j7m-9rv4
github.com/go-acme/lego
github.com/go-acme/lego/commit/238454b5f74f3cfcbb244ff0d0dc914a4ad44b96
github.com/go-acme/lego/security/advisories/GHSA-q82r-2j7m-9rv4
nvd.nist.gov/vuln/detail/CVE-2025-54799

Code Behaviors & Features

Detect and mitigate CVE-2025-54799 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →