CVE-2026-56862

Published: Aug 13, 2026Modified: Oct 24, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://go.dev/cl/804261

Source: security@golang.org

https://go.dev/issue/80528

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/94pEornpRlI

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2026-6090

Source: security@golang.org

Timeline

No history available yet.