--- id: CVE-2026-56862 aliases: - GO-2026-6090 - BIT-golang-2026-56862 title: Limit handshake messages we are willing to accept post-handshake in crypto/tls summary: Limit handshake messages we are willing to accept post-handshake in crypto/tls severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' vendor: stdlib product: stdlib ecosystem: go affected: - 'stdlib >= 1.27.0-0, < 1.27.0-rc.3' patched: - stdlib 1.27.0-rc.3 published: '2026-08-13' updated: '2026-09-25' sourceUpdated: '2026-09-25T10:41:52.830720820Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6090' references: - url: 'https://go.dev/issue/80528' - url: 'https://go.dev/cl/804261' - url: 'https://groups.google.com/g/golang-announce/c/94pEornpRlI' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56862.json - url: 'https://access.redhat.com/security/cve/CVE-2026-56862' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515839' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56862' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56862' - url: 'https://pkg.go.dev/vuln/GO-2026-6090' - url: 'https://access.redhat.com/errata/RHSA-2026:68334' - url: 'https://access.redhat.com/errata/RHSA-2026:68335' - url: 'https://access.redhat.com/errata/RHSA-2026:66350' - url: 'https://access.redhat.com/errata/RHSA-2026:66375' - url: 'https://access.redhat.com/errata/RHSA-2026:66356' - url: 'https://access.redhat.com/errata/RHSA-2026:68333' - url: 'https://access.redhat.com/errata/RHSA-2026:65918' - url: 'https://access.redhat.com/errata/RHSA-2026:67149' - url: 'https://access.redhat.com/errata/RHSA-2026:61882' - url: 'https://access.redhat.com/errata/RHSA-2026:67517' - url: 'https://access.redhat.com/errata/RHSA-2026:66459' - url: 'https://access.redhat.com/errata/RHSA-2026:65335' - url: 'https://access.redhat.com/errata/RHSA-2026:67974' - url: 'https://access.redhat.com/errata/RHSA-2026:66327' - url: 'https://access.redhat.com/errata/RHSA-2026:63332' - url: 'https://access.redhat.com/errata/RHSA-2026:64777' - url: 'https://access.redhat.com/errata/RHSA-2026:64788' - url: 'https://access.redhat.com/errata/RHSA-2026:62577' - url: 'https://access.redhat.com/errata/RHSA-2026:62578' - url: 'https://access.redhat.com/errata/RHSA-2026:60306' - url: 'https://access.redhat.com/errata/RHSA-2026:63022' - url: 'https://access.redhat.com/errata/RHSA-2026:63119' - url: 'https://access.redhat.com/errata/RHSA-2026:65534' - url: 'https://access.redhat.com/errata/RHSA-2026:62631' - url: 'https://access.redhat.com/errata/RHSA-2026:65116' - url: 'https://access.redhat.com/errata/RHSA-2026:65895' - url: 'https://access.redhat.com/errata/RHSA-2026:63127' - url: 'https://access.redhat.com/errata/RHSA-2026:64818' - url: 'https://access.redhat.com/errata/RHSA-2026:63163' - url: 'https://access.redhat.com/errata/RHSA-2026:60305' - url: 'https://access.redhat.com/errata/RHSA-2026:62407' - url: 'https://access.redhat.com/errata/RHSA-2026:63124' - url: 'https://access.redhat.com/errata/RHSA-2026:64786' - url: 'https://access.redhat.com/errata/RHSA-2026:62602' tags: - osv - go - csaf - vex - red-hat epss: 0.00568 epssPercentile: 0.44826 cvssSource: vendor cwe: - CWE-1050 ingestedAt: '2026-08-14T19:18:46.593Z' --- ## Overview Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. ## Affected packages - `stdlib >= 1.27.0-0, < 1.27.0-rc.3` ## Remediation Upgrade to a patched release: - `stdlib 1.27.0-rc.3` ## Vendor advisories - **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334) - **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335) - **RHSA-2026:66350** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66350) - **RHSA-2026:66375** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66375) - **RHSA-2026:66356** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66356) - **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333) - **RHSA-2026:65918** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65918) - **RHSA-2026:67149** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67149) - **RHSA-2026:61882** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61882) - **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517) - **RHSA-2026:66459** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66459) - **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56862.json) - **RHSA-2026:65335** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65335) - **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327) - **RHSA-2026:63332** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63332) - **RHSA-2026:64777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64777) - **RHSA-2026:64788** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64788) - **RHSA-2026:62577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62577) - **RHSA-2026:62578** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62578) - **RHSA-2026:60306** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60306) - **RHSA-2026:63022** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63022) - **RHSA-2026:63119** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63119) - **RHSA-2026:65534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65534)