CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls
A malicious client can cause a denial of service by sending excessive KeyUpdate messages, forcing indefinite key derivation operations in the Go crypto/tls library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56862?
CVE-2026-56862 is a high-severity denial of service vulnerability in Go standard library crypto/tls, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Weakness: CWE-770
Which versions are affected by CVE-2026-56862?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.25.13, 1.26.6, 1.27.0 |
stdlib Go | All versions | 1.25.13, 1.26.6, 1.27.0-rc.3 |
Linux distribution packages (4)
ose-gcp-gcr-image-credential-provider Red Hat:openshift:4.21::el10 | All versions | 0:4.21.0-202609141848.p2.g0b668ce.assembly.stream.el10 |
ose-gcp-gcr-image-credential-provider Red Hat:openshift:4.21::el8 | All versions | 0:4.21.0-202609141848.p2.g0b668ce.assembly.stream.el8 |
ose-gcp-gcr-image-credential-provider Red Hat:openshift:4.21::el9 | All versions | 0:4.21.0-202609141848.p2.g0b668ce.assembly.stream.el9 |
mihomo openSUSE:Tumbleweed | All versions | 1.19.30-1.1 |
How do I fix CVE-2026-56862?
Upgrade golang to a fixed version for your release line: 1.25.13, 1.26.6 or 1.27.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-56862 being exploited?
There is no known exploitation of CVE-2026-56862 in the wild and no public exploit code.
Sources
Also known as AZL-96662, AZL-96668, AZL-98616, BELL-CVE-2026-56862, BIT-golang-2026-56862, CLEANSTART-2026-BU89282 and 2158 more.