Skip to content
OpenAdvisories

Product · Go standard library

crypto/tls

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-97031

    Reject malformed ECH outer extension references in crypto/tls

    Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and …

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-56862

    Limit handshake messages we are willing to accept post-handshake in crypto/tls

    Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go