CVE-2026-32283 — Go security advisory

CVE-2026-32283: A vulnerability in Go allows a TLS connection to deadlock if one side sends multiple key update messages post-handshake in a single record, leading to uncontrolled resource consumption.

Risk and impact

This vulnerability can lead to a denial of service (DoS) by causing the connection to become unresponsive due to resource exhaustion.

Recommended action

Upgrading to Go versions 1.26.2 or later is recommended to mitigate the vulnerability. Developers should apply the latest patches and ensure their applications are using the fixed versions.