CVE-2026-56862

EUVD-2026-58511
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 44.85%
Debian logo
Debian Releases
Debian Product
Codename
golang-1.19
bookworm
postponed
golang-1.24
trixie
no-dsa
golang-1.25
forky
vulnerable
golang-1.26
forky
1.26.8-1
fixed
sid
1.26.8-1
fixed
golang-1.27
forky
1.27.1-2
fixed
sid
1.27.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang
jammy
dne
noble
dne
resolute
dne
golang-1.6
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
golang-1.8
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.9
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.10
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
golang-1.13
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
xenial
needs-triage
golang-1.14
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.16
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.17
jammy
needs-triage
noble
dne
resolute
dne
golang-1.18
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
xenial
needs-triage
golang-1.20
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
golang-1.21
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
golang-1.22
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
golang-1.23
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
golang-1.24
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
golang-1.25
jammy
dne
noble
dne
resolute
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
buildah
RHEL 9
2:1.43.3-2.el9_8
fixed
buildah-tests
RHEL 9
2:1.43.3-2.el9_8
fixed
containernetworking-plugins
RHEL 9
1:1.9.0-4.el9_8
fixed
git-lfs
RHEL 9
0:3.7.1-4.el9_8.3
fixed
go-toolset
RHEL 9
0:1.26.7-1.el9_8
fixed
golang
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-bin
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-docs
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-misc
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-race
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-src
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-tests
RHEL 9
0:1.26.7-1.el9_8
fixed
grafana
RHEL 8
0:9.2.10-33.el8_10
fixed
RHEL 9
0:10.2.6-23.el9_8.3
fixed
grafana-pcp
RHEL 9
0:5.1.1-17.el9_8.1
fixed
grafana-selinux
RHEL 8
0:9.2.10-33.el8_10
fixed
RHEL 9
0:10.2.6-23.el9_8.3
fixed
image-builder
RHEL 9
0:52.1-1.el9_8.2
fixed
opentelemetry-collector
RHEL 9
0:0.152.1-2.el9_8
fixed
osbuild-composer
RHEL 8
0:101.5-2.el8_10
fixed
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
RHEL 9
0:165.1-4.el9_8.1
fixed
osbuild-composer-core
RHEL 8
0:101.5-2.el8_10
fixed
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
RHEL 9
0:165.1-4.el9_8.1
fixed
osbuild-composer-dnf-json
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
osbuild-composer-worker
RHEL 8
0:101.5-2.el8_10
fixed
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
RHEL 9
0:165.1-4.el9_8.1
fixed
podman
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-docker
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-plugins
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-remote
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-tests
RHEL 9
6:5.8.2-7.el9_8
fixed
rhc
RHEL 9
1:0.2.7-11.el9_8
fixed
rhc-devel
RHEL 9
1:0.2.7-11.el9_8
fixed
skopeo
RHEL 9
2:1.22.2-8.el9_8
fixed
skopeo-tests
RHEL 9
2:1.22.2-8.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
golang
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-bin
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-docs
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-misc
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-shared
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-src
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-tests
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://go.dev/cl/804261
https://go.dev/issue/80528
https://groups.google.com/g/golang-announce/c/94pEornpRlI
https://pkg.go.dev/vuln/GO-2026-6090