High [CVE-2026-56862] Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
This high-severity Red Hat Linux advisory covers CVE-2026-56862 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
A flaw was found in the `crypto/tls` package, part of `golang`. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.
A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations.
This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-1050.
Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 52 more.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- golang-0:1.26.7-1.el10_2
- go-fdo-client-0:1.0.0-4.el10_2.7
- go-fdo-server-0:1.0.1-2.el10_2.4
- golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.3
- grafana-0:10.2.6-28.el10_2.5
- grafana-pcp-0:5.3.0-8.el10_2.1
- rhc-1:0.3.8-7.el10_2
- buildah-2:1.43.1-5.el10_2
- buildah-2:1.43.1-6.el10_2
- git-lfs-0:3.7.1-5.el10_2.7
- skopeo-2:1.22.2-5.el10_2
- opentelemetry-collector-0:0.152.1-2.el10_2
- image-builder-0:52.1-1.el10_2.2
- osbuild-composer-0:165.1-3.el10_2.2
- golang-0:1.26.7-1.el10_0
- ignition-0:2.21.0-3.el10_0.4
- delve-0:1.26.1-2.el10_0
- osbuild-composer-0:134.1-12.el10_0
- grafana-pcp-0:5.3.0-1.el10_0.1
- go-toolset:rhel8-8100020260824145918.a3795dee
- grafana-0:9.2.10-33.el8_10
- grafana-pcp-0:5.1.1-18.el8_10
- container-tools:rhel8-8100020260901110702.afee755d
- rhc-1:0.2.5-10.el8_10
- osbuild-composer-0:101.5-2.el8_10
- golang-0:1.26.7-1.el9_8
- grafana-0:10.2.6-23.el9_8.3
- rhc-1:0.2.7-11.el9_8
- grafana-pcp-0:5.1.1-17.el9_8.1
- opentelemetry-collector-0:0.152.1-2.el9_8
- osbuild-composer-0:165.1-4.el9_8.1
- image-builder-0:52.1-1.el9_8.2
- git-lfs-0:3.7.1-4.el9_8.3
- golang-0:1.26.7-1.el9_2
- osbuild-composer-0:76.1-9.el9_2
- ignition-0:2.15.0-2.el9_2.1
- golang-0:1.26.7-1.el9_4
- osbuild-composer-0:101.3-4.el9_4.6
- ignition-0:2.17.0-2.el9_4.2
- golang-0:1.26.7-1.el9_6
- RHSA-2026:60306
- RHSA-2026:62577
- RHSA-2026:62578
- RHSA-2026:62631
- RHSA-2026:63022
- RHSA-2026:63119
- RHSA-2026:63127
- RHSA-2026:63332
- RHSA-2026:64777
- RHSA-2026:64788
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation
Upgrade to a fixed release: golang-0:1.26.7-1.el10_2, go-fdo-client-0:1.0.0-4.el10_2.7, go-fdo-server-0:1.0.1-2.el10_2.4, golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.3, grafana-0:10.2.6-28.el10_2.5, grafana-pcp-0:5.3.0-8.el10_2.1. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.