Executive brief
A vulnerability in the Go programming language's standard networking library can allow an attacker to crash or freeze applications that use secure TLS 1.3 connections. By sending a specifically crafted sequence of security key update messages, an attacker can cause the connection to enter a deadlock state, consuming system resources and making the service unavailable to legitimate users. This issue primarily impacts the availability of web servers and other networked services built with Go.
Technical details
A denial of service vulnerability exists in the Go crypto/tls standard library package due to improper handling of post-handshake messages in TLS 1.3. If a remote peer sends multiple 'key update' messages within a single TLS record, the connection can enter a deadlock state. This deadlock leads to uncontrolled resource consumption, effectively causing a denial of service (DoS) for the affected connection and potentially the host process. The issue is triggered post-handshake and does not require authentication. It has been patched in Go versions 1.25.9 and 1.26.2.
Affected products
- Google Go before 1.25.9, from 1.26.0 before 1.26.2
Timeline
- 2026-03-24: disclosed: Issue opened in Go project repository
- 2026-04-07: advisory: Go vulnerability report published
- 2026-04-08: advisory: NVD record published
- 2026-04-23: patched: Red Hat security updates released