Not rated
CVE-2022-41724 Large handshake records may cause panics in crypto/tls
Description
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto/tls 1.20 | 1.20.0-0 → < 1.20.1 | 1.20.1 |
| crypto/tls 1.19 | earliest → < 1.19.6 | 1.19.6 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- security.gentoo.org security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of crypto/tls
The 13 CVEs of crypto/tls →
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted…
7.5
High
CVE-2026-56862
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has…
7.5
High
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of…
5.3
Medium
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…
7.5
High