CVE-2026-56862

Received Received - Intake

KeyUpdate Message Induced DoS in Go

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-56862

EUVD

EUVD-2026-58511

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in how handshake messages, specifically KeyUpdate, are processed. Normally, these messages should only advance the state after a handshake is complete. However, in this case, the server treats every KeyUpdate message as state-advancing, even if no handshake has occurred. This allows an attacker to repeatedly send KeyUpdate messages, forcing the server to continuously perform key derivation operations without end.

Impact Analysis

This vulnerability can lead to denial-of-service conditions. An attacker could exploit it to consume excessive server resources, causing performance degradation or complete service unavailability. Systems relying on secure handshakes for communication may become unresponsive or crash under sustained attack.

Mitigation Strategies

Update Go to the latest version to patch the vulnerability. Monitor network traffic for excessive KeyUpdate messages. Implement rate limiting on handshake operations.

Hi! I’m here to help you understand CVE-2026-56862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70