{"id":"CVE-2026-32283","summary":"Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls","details":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.","aliases":["BIT-golang-2026-32283","GO-2026-4870"],"modified":"2026-07-04T03:56:07.324642356Z","published":"2026-04-08T01:06:57.670Z","related":["ALSA-2026:14200","ALSA-2026:16875","ALSA-2026:17075","ALSA-2026:19126","ALSA-2026:19133","ALSA-2026:19134","ALSA-2026:19135","ALSA-2026:19136","ALSA-2026:19137","ALSA-2026:19139","ALSA-2026:19350","ALSA-2026:19351","ALSA-2026:19352","ALSA-2026:19353","ALSA-2026:23102","ALSA-2026:24470","ALSA-2026:26447","ALSA-2026:28074","ALSA-2026:29035","ALSA-2026:29195","ALSA-2026:29455","ALSA-2026:29703","ALSA-2026:33722","CGA-w7vv-7vph-696h","SUSE-SU-2026:1320-1","SUSE-SU-2026:1321-1","SUSE-SU-2026:1580-1","SUSE-SU-2026:1581-1","SUSE-SU-2026:21355-1","SUSE-SU-2026:21356-1","openSUSE-SU-2026:10514-1","openSUSE-SU-2026:10525-1","openSUSE-SU-2026:10664-1","openSUSE-SU-2026:20570-1","openSUSE-SU-2026:20571-1","openSUSE-SU-2026:20703-1"],"database_specific":{"cna_assigner":"Go","unresolved_ranges":[{"extracted_events":[{"fixed":"1.25.9"},{"introduced":"1.26.0-0"},{"fixed":"1.26.2"}],"source":"AFFECTED_FIELD"}],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32283.json"},"references":[{"type":"WEB","url":"https://go.dev/cl/763767"},{"type":"WEB","url":"https://go.dev/issue/78334"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"},{"type":"WEB","url":"https://pkg.go.dev"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2026-4870"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10217"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10219"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11507"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11514"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11711"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11863"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11881"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14162"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14200"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14391"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:15980"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16021"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16024"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16101"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16102"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16875"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17075"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17084"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17287"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18027"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18032"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19126"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19132"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19133"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19134"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19135"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19136"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19137"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19139"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19144"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19156"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19350"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19351"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19352"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19353"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19369"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19450"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19550"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19634"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19714"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19715"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19719"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19720"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19721"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19722"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19750"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19839"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20556"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20569"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20570"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20607"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21769"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22347"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22423"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22450"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22485"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22709"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22714"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22937"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23102"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23103"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23228"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23345"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24337"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24470"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26447"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26636"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27076"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28038"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28047"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28074"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29035"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29195"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29455"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29703"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33722"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34192"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34196"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34365"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7291"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7385"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-32283"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32283.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/golang/go","events":[{"introduced":"0"},{"fixed":"7076e01d9d450bae9f25be76f45d58cc52e2aad2"},{"introduced":"d90b98e65320778f3b1f99a6951ab20f04d218b3"},{"fixed":"9c8bf0e72a6fb3b415b591b124b59fbb7cf92252"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.25.9"},{"introduced":"1.26.0"},{"fixed":"1.26.2"}],"cpe":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","source":"CPE_RANGE"}}],"versions":["go1.26.1","go1.25.8","go1.25.7","go1.26.0","go1.25.6","go1.25.5","go1.25.4","go1.25.3","go1.25.2","go1.25.1","go1.25.0","go1.25rc3","go1.25rc2","go1.25rc1","go1.19beta1","go1.18beta2","go1.18beta1","go1.17beta1","go1.16beta1","go1.15beta1","go1.14beta1","go1.13beta1","go1.12beta2","go1.12beta1","go1.11beta3","go1.11beta2","go1.11beta1","go1.10rc2","go1.10rc1","go1.10beta2","go1.10beta1","go1.9beta2","go1.9beta1","go1.8beta2","go1.8beta1","go1.7rc4","go1.7rc3","go1.7rc2","go1.7rc1","go1.7beta2","go1.7beta1","go1.6beta2","go1.6beta1","go1.5beta3","go1.5beta2","go1.5beta1","go1.4beta1","go1.3beta2","go1.3beta1","weekly.2012-03-27","weekly","weekly.2012-03-22","weekly.2012-03-13","weekly.2012-03-04","weekly.2012-02-22","weekly.2012-02-14","weekly.2012-02-07","weekly.2012-01-27","weekly.2012-01-20","weekly.2012-01-15","weekly.2011-12-22","weekly.2011-12-14","weekly.2011-12-06","weekly.2011-12-02","weekly.2011-12-01","weekly.2011-11-18","weekly.2011-11-09","weekly.2011-11-08","weekly.2011-11-02","weekly.2011-11-01","weekly.2011-10-26","weekly.2011-10-25","weekly.2011-10-18","weekly.2011-10-06","weekly.2011-09-21","weekly.2011-09-16","weekly.2011-08-17","weekly.2011-09-07","weekly.2011-09-01","weekly.2011-08-10","weekly.2011-07-07","weekly.2011-07-29","weekly.2011-07-19","weekly.2011-06-09","weekly.2011-06-23","weekly.2011-06-16","weekly.2011-06-02","weekly.2011-05-22","weekly.2011-04-27","weekly.2011-04-13","weekly.2011-04-04","weekly.2011-03-28","weekly.2011-03-15","weekly.2011-03-07.1","release.r56","weekly.2011-03-07","weekly.2011-02-24","weekly.2011-02-15","weekly.2011-02-01.1","weekly.2011-02-01","weekly.2011-01-20","weekly.2011-01-19","weekly.2011-01-12","weekly.2011-01-06","weekly.2010-12-22","weekly.2010-12-15.1","weekly.2010-12-15","weekly.2010-12-08","weekly.2010-12-02","weekly.2010-11-23","weekly.2010-11-10","weekly.2010-11-02","weekly.2010-10-27","weekly.2010-10-20","weekly.2010-10-13.1","weekly.2010-10-13","weekly.2010-09-29","weekly.2010-09-22","weekly.2010-09-15","weekly.2010-09-06","weekly.2010-08-25","weekly.2010-08-11","weekly.2010-08-04","weekly.2010-07-29","weekly.2010-07-14","weekly.2010-07-01","weekly.2010-06-21","weekly.2010-06-09","weekly.2010-05-27","weekly.2010-05-04","weekly.2010-04-27","weekly.2010-04-13","weekly.2010-03-30","weekly.2010-03-22","weekly.2010-03-15","weekly.2010-03-04","weekly.2010-02-23","weekly.2010-02-17","weekly.2010-02-04","weekly.2010-01-27","weekly.2010-01-13","weekly.2010-01-05","weekly.2009-12-22","weekly.2009-12-09","weekly.2009-12-07","weekly.2009-11-17","weekly.2009-11-12","weekly.2009-11-10.1","weekly.2009-11-10","weekly.2009-11-06"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32283.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}