{"id":"GO-2026-6090","aliases":["BIT-golang-2026-56862","CVE-2026-56862"],"title":"Limit handshake messages we are willing to accept post-handshake in crypto/tls","titleSource":"OSV","descriptionSource":"OSV","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.","severity":"unknown","score":null,"published":"2026-08-13T21:43:54.000Z","modified":"2026-11-14T13:12:14.954Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"stdlib","sources":[{"name":"OSV · GO-2026-6090","url":"https://osv.dev/vulnerability/GO-2026-6090"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.25.13"},{"introduced":"1.26.0-0"},{"fixed":"1.26.6"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0-rc.3"}],"type":"SEMVER"}],"versions":[],"fixed":["1.25.13","1.26.6","1.27.0-rc.3"]}],"sourceAffected":[],"references":["https://go.dev/issue/80528","https://go.dev/cl/804261","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"sources":[{"name":"OSV","id":"GO-2026-6090","modified":"2026-11-14T13:12:14.954574379Z","url":"https://osv.dev/vulnerability/GO-2026-6090"}],"assessments":[],"products":[],"remediation":[],"observedAt":"2026-11-14T15:04:35.349Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:20:35.853Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T00:25:35.612Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T00:15:33.829Z","attemptedAt":"2026-11-14T00:15:33.829Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-14T00:15:34.397Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T00:15:33.038Z","attemptedAt":"2026-11-14T00:15:33.038Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-56862","url":"https://www.first.org/epss/","probability":0.00568,"percentile":0.4762,"date":"2026-11-13","checkedAt":"2026-11-14T00:15:33.038Z"},{"source":"GitHub Advisory Database","id":"GHSA-7qch-w8m5-g3h3","url":"https://github.com/advisories/GHSA-7qch-w8m5-g3h3","modified":"2026-08-14T18:31:34Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-14T00:15:33.829Z"}],"aiSummary":null}