---
title: "GHSA-j443-wcqq-xprh: Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go"
url: https://erroneo.us/security/ghsa/GHSA-j443-wcqq-xprh/
description: "GHSA-j443-wcqq-xprh (critical, Go): Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go.…"
type: advisory
section: "Security Digest"
date_published: 2026-03-11
date_modified: 2026-03-11
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-j443-wcqq-xprh"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-j443-wcqq-xprh: Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go

## Affected packages

- Go `github.com/arslanbekov/terraform-provider-sendgrid` <= 1.1.3-0.20250606002314-b4a2dfeb7b0f → fixed: none listed

## Details

Summary A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version. If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list. As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session. Details If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list. Consequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.

## Sources

- [GitHub Advisory GHSA-j443-wcqq-xprh](https://github.com/advisories/GHSA-j443-wcqq-xprh)
- [github.com](https://github.com/arslanbekov/terraform-provider-sendgrid/security/advisories/GHSA-j443-wcqq-xprh)
- [github.com](https://github.com/advisories/GHSA-h355-32pf-p2xm)
- [security.snyk.io](https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TERRAFORMPROVIDERSENDGRID-15265295)

---
Source page: https://erroneo.us/security/ghsa/GHSA-j443-wcqq-xprh/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt