HarborGuard / CVE
Back to search
HIGHCVE-2026-32283Published Modified CNA Go

CVE-2026-32283: Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Metrics

CVSS v3.1
7.5
Severity
HIGH
Fixed in
1.25.9
Affected Products
1

Fix available

1.25.91.26.2
Affected packages
  • Go standard library / crypto/tls
    < 1.25.9 (from 0) · < 1.26.2 (from 1.26.0-0)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References