Fluid Attacks Database

Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel8	git-lfs	<0:3.4.1-10.el8_10	0:3.4.1-10.el8_10
rpm rhel10	golang	<0:1.25.9-3.el10_1	0:1.25.9-3.el10_1
rpm rhel9	grafana	<0:10.2.6-22.el9_8	0:10.2.6-22.el9_8
rpm rhel8	osbuild-composer	<0:101.5-1.el8_10	0:101.5-1.el8_10
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
rpm rhel9.6	opentelemetry-collector	<0:0.144.0-2.el9_6	0:0.144.0-2.el9_6
rpm rhel10.0	golang	<0:1.25.9-1.el10_0	0:1.25.9-1.el10_0
rpm rhel10.0	grafana-pcp	<0:5.2.2-6.el10_0	0:5.2.2-6.el10_0
rpm rhel10	go-fdo-server	<0:1.0.1-1.el10_2	0:1.0.1-1.el10_2
rpm rhel10	opentelemetry-collector	<0:0.144.0-2.el10_2	0:0.144.0-2.el10_2

1-10 of 82

Aliases

1. CVE-2026-322832. NVD-2026-322833. OSV-2026-322834. OSV-DEBIAN-2026-322835. OSV-GO-2026-48706. GCVE-2026-322837. SECURITY-TRACKER-CVE-2026-32283

References

1. https://go.dev/cl/7637672. https://go.dev/issue/783343. https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.