CVE-2026-32283: Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32283?
CVE-2026-32283 is a critical vulnerability that can lead to a denial of service due to resource exhaustion.
How do I fix CVE-2026-32283?
To mitigate CVE-2026-32283, upgrade to Go version 1.25.9 or later, or ensure your version is between 1.26.0 to 1.26.2.
Which software is affected by CVE-2026-32283?
CVE-2026-32283 affects the Go crypto/tls library in versions prior to 1.25.9 and between 1.26.0 to 1.26.2.
What are the potential impacts of CVE-2026-32283?
CVE-2026-32283 can lead to persistent connection retention and denial-of-service through uncontrolled resource consumption.
Is CVE-2026-32283 exploitable remotely?
Yes, CVE-2026-32283 can be exploited over a network connection as it involves the TLS protocol.