Vulnerability GO-2026-6090
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
August 13, 2026 at 09:43 PM UTC
Limit handshake messages we are willing to accept post-handshake in crypto/tls
<1.25.13, >=1.26.0-0 <1.26.6, >=1.27.0-0 <1.27.0-rc.3
<1.25.13, >=1.26.0-0 <1.26.6, >=1.27.0-0 <1.27.0-rc.3
Summary
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Details
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 days ago
HTTP/1 server crash due to MaxBytesReader header race in net/http
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6859
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6859
Unknown
23 days ago
Distrust compromised intermediate certificates in crypto/x509
<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809
<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809
Unknown
1 month ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
1 month ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
1 month ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Impacted packages
Timeline
Published
3 months ago
August 13, 2026 at 09:43 PM UTC
Last Modified
1 hour ago
November 13, 2026 at 07:12 PM UTC