CVE-2026-32283: Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
Other sources
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.25.9-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.2-r0 - Upgrade
Upgrade
alpine/rcloneto a version that resolves this vulnerability.Fixed in 1.73.5-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32283?
CVE-2026-32283 is a critical vulnerability that can lead to a denial of service due to resource exhaustion.
How do I fix CVE-2026-32283?
To mitigate CVE-2026-32283, upgrade to Go version 1.25.9 or later, or ensure your version is between 1.26.0 to 1.26.2.
Which software is affected by CVE-2026-32283?
CVE-2026-32283 affects the Go crypto/tls library in versions prior to 1.25.9 and between 1.26.0 to 1.26.2.
What are the potential impacts of CVE-2026-32283?
CVE-2026-32283 can lead to persistent connection retention and denial-of-service through uncontrolled resource consumption.
Is CVE-2026-32283 exploitable remotely?
Yes, CVE-2026-32283 can be exploited over a network connection as it involves the TLS protocol.