Vulnerability GO-2026-4870

Unknown

5 months ago

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

<1.25.9

Summary

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Details

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.

This only affects TLS 1.3.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

1 month ago

Enforce maximum recursion depth in encoding/asn1

<1.25.13 GO-2026-5972

Unknown

1 month ago

Add recursion depth guard during decode in encoding/xml

<1.25.13 GO-2026-6088

Unknown

1 month ago

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

<1.25.13 GO-2026-6089

Unknown

1 month ago

Limit handshake messages we are willing to accept post-handshake in crypto/tls

<1.25.13 GO-2026-6090

Unknown

1 month ago

Fix Javascript regexp context tracking in html/template

<1.25.13 GO-2026-6091

View all vulnerabilities for these packages

Impacted packages

stdlib

Timeline

Published

5 months ago

Last Modified

2 hours ago