CVE-2026-32283: If one side of the TLS connection sends multiple key update messages post-handshake in a single record,...

CVE-2026-32283: If one side of the TLS connection sends multiple key update messages post-handshake in a single record,...

CVE-2026-32283: A vulnerability in Go allows a remote attacker to cause a denial of service by sending multiple key update messages post-handshake in a single record, leading to resource exhaustion.

The vulnerability can lead to a denial of service (DoS) by causing uncontrolled resource consumption in TLS 1.3 connections. It affects Go versions 1.26.0 and earlier.

Recommended action: Upgrade to Go 1.25.9 or 1.26.2 to fix the vulnerability. Apply the official patches provided by the Go team.

Read the verified Go brief on DevCurrent: https://devcurrent.net/cve/CVE-2026-32283?utm_source=devto&utm_medium=community&utm_campaign=editorial_distribution&utm_content=178