CVE-2026-56862

Received Received - Intake

KeyUpdate Message Induced DoS in Go

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: Go Project

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-56862

EUVD

EUVD-2026-58511

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.25.13 (exc)
golang	go	From 1.26.0 (inc) to 1.26.5 (inc)
golang	go	From 1.27.0 (inc) to 1.27.0-rc.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in how handshake messages, specifically KeyUpdate, are processed. Normally, these messages should only advance the state after a handshake is complete. However, in this case, the server treats every KeyUpdate message as state-advancing, even if no handshake has occurred. This allows an attacker to repeatedly send KeyUpdate messages, forcing the server to continuously perform key derivation operations without end.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual TLS handshake activity, particularly repeated KeyUpdate messages before handshake completion. Check server logs for excessive KeyUpdate handshake messages or continuous key derivation operations. Use network monitoring tools like Wireshark to inspect TLS 1.3 handshake sequences for anomalies. Ensure your Go version is updated to a patched release.

Impact Analysis

This vulnerability can lead to denial-of-service conditions. An attacker could exploit it to consume excessive server resources, causing performance degradation or complete service unavailability. Systems relying on secure handshakes for communication may become unresponsive or crash under sustained attack.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through excessive key derivation operations. This may lead to service disruptions, affecting data availability and integrity, which are critical under these regulations.

Mitigation Strategies

Update Go to the latest version to patch the vulnerability. Monitor network traffic for excessive KeyUpdate messages. Implement rate limiting on handshake operations.

Hi! I’m here to help you understand CVE-2026-56862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70