CVE-2026-32283

Modified Modified - Updated After Analysis

TLS 1.3 Key Update Deadlock Causes Denial of Service

Publication date: 2026-04-08

Last updated on: 2026-07-06

Assigner: Go Project

Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-08

Last Modified

2026-07-06

Generated

2026-07-06

AI Q&A

2026-04-08

EPSS Evaluated

2026-07-05

NVD

CVE-2026-32283

EUVD

EUVD-2026-20014

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.25.9 (exc)
golang	go	From 1.26.0 (inc) to 1.26.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-764	The product locks a critical resource more times than intended, leading to an unexpected state in the system.

Attack-Flow Graph

Executive Summary

CVE-2026-32283 is a vulnerability in the Go standard library's crypto/tls package that affects TLS 1.3 connections. It occurs when one side of a TLS connection sends multiple key update messages after the handshake phase within a single record. This causes the connection to deadlock, which leads to uncontrolled consumption of resources.

Impact Analysis

The vulnerability can cause the TLS connection to deadlock, resulting in uncontrolled resource consumption. This can lead to a denial of service (DoS) condition, where the affected system or application becomes unresponsive or unable to handle legitimate requests.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Go programming language to a fixed version that addresses the issue.

Upgrade to Go version 1.25.9 or later if you are using a 1.25.x release.
If using Go 1.26.0-0 up to but not including 1.26.2, upgrade to at least 1.26.2 or later.

These updates include the fix for the deadlock caused by multiple key update messages in TLS 1.3 connections, preventing uncontrolled resource consumption and denial of service.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-32283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70