Fluid Attacks Database

Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	golang-1.25	=1.25.0-1 \|\| =1.25.0-2 \|\| =1.25.1-1 \|\| =1.25.2-1 \|\| =1.25.3-1 \|\| =1.25.6-1 \|\| =1.25.7-1 \|\| =1.25.7-2 \|\| =1.25.8-1 \|\| >=0 <1.25.9-1	1.25.9-1
debian 14	golang-1.26	=1.26.0-1 \|\| =1.26.1-1 \|\| =1.26~rc2-1 \|\| =1.26~rc3-1 \|\| =1.26~rc3-2 \|\| >=0 <1.26.2-1	1.26.2-1
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
debian 12	golang-1.19	=1.19.10-1 \|\| =1.19.10-2 \|\| =1.19.11-1 \|\| =1.19.12-1 \|\| =1.19.12-2 \|\| =1.19.12-2~bpo11+1 \|\| =1.19.12-2~bpo12+1 \|\| =1.19.13-1 \|\| =1.19.13-1~bpo11+1 \|\| =1.19.13-1~bpo12+1 \|\| =1.19.8-2 \|\| =1.19.9-1	-
go	stdlib	>=0 <1.25.9	1.25.9
debian 13	golang-1.24	=1.24.12-1 \|\| =1.24.13-1 \|\| =1.24.13-2 \|\| =1.24.4-1 \|\| =1.24.4-2 \|\| =1.24.4-3 \|\| =1.24.4-4 \|\| =1.24.7-1 \|\| =1.24.8-1 \|\| =1.24.9-1	-
rpm rhel9	skopeo	-	-
rpm rhel7	rhc	-	-
rpm rhel9	containernetworking-plugins	-	-
rpm rhel9	git-lfs	<0:3.6.1-8.el9_7.1 \|\| >=0:3.7.1, <0:3.7.1-4.el9_8	0:3.7.1-4.el9_8

1-10 of 81

Aliases

1. CVE-2026-322832. NVD-2026-322833. OSV-DEBIAN-2026-322834. OSV-2026-322835. OSV-GO-2026-48706. GCVE-2026-322837. SECURITY-TRACKER-CVE-2026-32283

References

1. https://go.dev/cl/7637672. https://go.dev/issue/783343. https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.