If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
| Vendor | Product | Versions |
|---|---|---|
| go standard library | crypto/tls | 0, 1.26.0-0, 1.25.8, 1.26.1 |
Updated affected versions, severity to HIGH, marked as actively exploited, and added CWE-664 and MITRE ATT&CK technique T1203.
Initial creation
