GHSA-jrg3-gfjw-hm96Published

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Related advisories and sources

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-32283 · CVE overview and exploitation status

EUVD-2026-20014

GHSA-jrg3-gfjw-hm96

GO-2026-4870

BIT-golang-2026-32283

cve-program · CVE-2026-32283

euvd · EUVD-2026-20014

nvd · CVE-2026-32283

osv · GO-2026-4870

Related changes

Linked by CVE identifier

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS … · Advisory content revised · 9 Nov 2026
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS … · Advisory content revised · 7 Nov 2026
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS … · Advisory content revised · 1 Nov 2026
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS … · Advisory content revised · 30 Oct 2026
Release 2026-05-29 · Tool release · 4 Jun 2026