IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.5Hoch

CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go standard library crypto/tls; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Pl… Veröffentlicht: (vor 7 Monaten)

Beschreibung

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Schwachstellentyp (CWE): CWE-667CWE-764CWE-770

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
amq streams 3.2 —
ansible automation platform 2.5 —
ansible automation platform 2.6 —
cryostat 4 —
edge manager 1.0 —
edge manager 1.1 —
Go standard library crypto/tls < 1.25.9, 1.26.0-0 – < 1.26.2
golang go < 1.25.9
lightspeed for runtimes 1.0 —
multicluster globalhub 1.3 —
multicluster globalhub 1.4 —
multicluster globalhub 1.5 —
multicluster globalhub 1.6 —
openshift 4.15 —
openshift 4.19 —
openshift 4.21 —
openshift ai 2.25 —
openshift ai 3.4 —
openshift api data protection 1.5 —
openshift compliance operator 1 —
openshift custom metrics autoscaler 2.19 —
openshift distributed tracing 3.11 —
openshift distributed tracing 3.9 —
openstack 16.2 —
openstack 17.1 —
openstack 18.0 —
quay 3.10 —
quay 3.12 —
quay 3.9 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
rhmt 1.8 —
satellite 6.16 —
satellite 6.19 —
webterminal 1.11 —
webterminal 1.12 —
webterminal 1.13 —
webterminal 1.14 —
webterminal 1.15 —

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.25.9
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.26.0 < 1.26.2

Neue CVEs im selben Produkt — Go

6.8Mittel
CVE-2026-111943

Distrust compromised intermediate certificates in crypto/x509

Go standard library crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

7.5Hoch
CVE-2026-97032

HTTP/2 server crash due to HPACK encoder race in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part …

7.5Hoch
CVE-2026-78660

HTTP/2 transport accepts malformed framing-related headers in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such header…

9.1Kritisch
CVE-2026-78663

Double flow control refund on HTTP/2 server streams in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…