Veille CVE

Recherche « Go standard library crypto/tls »

3 CVE

Critique 0 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Go standard library crypto/tls » ✕
  1. CVE-2026-97031 7.5 Élevée

    Go standard library crypto/tls

    Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

  2. CVE-2026-56862 7.5 Élevée

    Go standard library crypto/tls

    Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

  3. CVE-2026-42505 5.3 Moyenne

    Go standard library crypto/tls · Golang go

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.