Skip to content
fr Sign in
7.5 High

CVE-2026-32283 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…

Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Affected products and versions

Product Affected versions Fixed in
crypto/tls 1.26 1.26.0-0 → < 1.26.2 1.26.2
crypto/tls 1.25 earliest → < 1.25.9 1.25.9
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Red Hat Enterprise Linux Server (v. 7 ELS) Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Cryostat 4 on RHEL 9 4.1 earliest → < 4.1.1-7 4.1.1-7
Show the 150 other branches
Product Affected versions Fixed in
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Red Hat Enterprise Linux AppStream AUS (v.8.6) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.8.6) Versions not published
Red Hat Enterprise Linux AppStream TUS (v.8.6) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.0) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.4) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) Versions not published
Red Hat CodeReady Linux Builder EUS (v.9.6) Versions not published
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) Versions not published
Custom Metric Autoscaler 2.19 1780101239 earliest → < 1780101239 1780101239
Multicluster Global Hub 1.3.4 1779210675 earliest → < 1779210675 1779210675
Multicluster Global Hub 1.4.5 1779838819 earliest → < 1779838819 1779838819
Multicluster Global Hub 1.5.4 1779828691 earliest → < 1779828691 1779828691
Multicluster Global Hub 1.6.2 1780320809 earliest → < 1780320809 1780320809
OpenShift Compliance Operator 1 1781605005 earliest → < 1781605005 1781605005
Red Hat Hardened Images 1.25 earliest → < 1.25.9-1.hum1 1.25.9-1.hum1
Red Hat Lightspeed (formerly Insights) for Runtimes 1 1.0 earliest → < 1.0.3-1779996197 1.0.3-1779996197
Red Hat OpenShift distributed tracing 3.9.3 1778056245 earliest → < 1778056245 1778056245
Assisted Installer for Red Hat OpenShift Container Platform 2 Versions not published
Builds for Red Hat OpenShift Versions not published
cert-manager Operator for Red Hat OpenShift Versions not published
Confidential Compute Attestation Versions not published
Deployment Validation Operator Versions not published
External Secrets Operator for Red Hat OpenShift Versions not published
ExternalDNS Operator Versions not published
Fence Agents Remediation Operator Versions not published
File Integrity Operator Versions not published
Gatekeeper 3 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Logical Volume Manager Storage Versions not published
Machine Deletion Remediation Operator Versions not published
Migration Toolkit for Applications 8 Versions not published
Migration Toolkit for Containers Versions not published
mirror registry for Red Hat OpenShift Versions not published
mirror registry for Red Hat OpenShift 2 Versions not published
Multicluster Engine for Kubernetes Versions not published
Network Observability Operator Versions not published
Node HealthCheck Operator Versions not published
OpenShift API for Data Protection Versions not published
OpenShift Developer Tools and Services Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Power monitoring for Red Hat OpenShift Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Certification Program for Red Hat Enterprise Linux 9 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat JBoss Web Server 6 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Cluster Manager CLI Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift Dev Workspaces Operator Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift on AWS Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Web Terminal Versions not published
Security Profiles Operator Versions not published
Service Telemetry Framework 1.5 Versions not published
streams for Apache Kafka 3 Versions not published
Zero Trust Workload Identity Manager Versions not published
Zero Trust Workload Identity Manager - Tech Preview Versions not published
Red Hat Service Interconnect 1 Versions not published
Red Hat Service Interconnect 2 Versions not published
Red Hat Satellite 6.19 for RHEL 9 Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.4) Versions not published
Red Hat AI Inference Server Versions not published
RHEM 1.0 for RHEL 9 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 7 Extended Lifecycle Support Versions not published
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260803064027 earliest → < 8060020260803064027.ad008a3a 8060020260803064027.ad008a3a
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260515174849 earliest → < 8060020260515174849.ad008a3a 8060020260515174849.ad008a3a
Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020260515174849 earliest → < 8060020260515174849.ad008a3a 8060020260515174849.ad008a3a
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020260515174849 earliest → < 8060020260515174849.ad008a3a 8060020260515174849.ad008a3a
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.4 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat OpenStack Platform 17.1 for RHEL 9 Versions not published
Red Hat OpenStack Services on OpenShift 18.0 Versions not published
RHEM 1.1 for RHEL 10 Versions not published
RHEM 1.1 for RHEL 9 Versions not published
Compliance Operator 1 1781605005 earliest → < 1781605005 1781605005
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 1.0 earliest → < 1.0.3-1779996197 1.0.3-1779996197
Red Hat multicluster global hub 1.4.3 1779838819 earliest → < 1779838819 1779838819
Red Hat Migration Toolkit 1.8 1783914276 earliest → < 1783914276 1783914276
Red Hat multicluster global hub 1.5.2 1779828691 earliest → < 1779828691 1779828691
Red Hat OpenShift AI 2.25 1788185899 earliest → < 1788185899 1788185899
Red Hat OpenShift distributed tracing 3.9.1 1778056245 earliest → < 1778056245 1778056245
Multicluster Global Hub 1.5.6 1779828691 earliest → < 1779828691 1779828691
Multicluster Global Hub 1.6.4 1780320809 earliest → < 1780320809 1780320809
Red Hat multicluster global hub 1.5.0 1779828691 earliest → < 1779828691 1779828691
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat multicluster global hub 1.4.4 1779838819 earliest → < 1779838819 1779838819
Red Hat multicluster global hub 1.6.0 1780320809 earliest → < 1780320809 1780320809
Red Hat OpenShift distributed tracing 3.9.2 1778056245 earliest → < 1778056245 1778056245
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260803064027 earliest → < 8060020260803064027.ad008a3a 8060020260803064027.ad008a3a
Streams for Apache Kafka 3.2.1 Versions not published
Multicluster Global Hub 1.5.7 1779828691 earliest → < 1779828691 1779828691
Multicluster Global Hub 1.6.5 1780320809 earliest → < 1780320809 1780320809
Red Hat multicluster global hub 1.4.2 1779838819 earliest → < 1779838819 1779838819
Red Hat Migration Toolkit for Containers 1.8 1783914276 earliest → < 1783914276 1783914276
Red Hat multicluster global hub 1.5.1 1779828691 earliest → < 1779828691 1779828691
Red Hat OpenShift Container Platform 4.15 Versions not published
Red Hat OpenShift AI 3.4 1787089049 earliest → < 1787089049 1787089049
Red Hat OpenShift Container Platform 4.19 1787105202 earliest → < 1787105202 1787105202
Red Hat OpenShift Container Platform 4.21 1787013251 earliest → < 1787013251 1787013251
Red Hat Web Terminal 1.11 1786655676 earliest → < 1786655676 1786655676
Red Hat Web Terminal 1.12 1786654613 earliest → < 1786654613 1786654613
Red Hat Web Terminal 1.13 1786654596 earliest → < 1786654596 1786654596
Red Hat Web Terminal 1.14 1786655467 earliest → < 1786655467 1786655467
Red Hat Web Terminal 1.15 1786654867 earliest → < 1786654867 1786654867
Red Hat multicluster global hub 1.5.3 1779828691 earliest → < 1779828691 1779828691
Red Hat OpenShift distributed tracing 3.11.0 1788356473 earliest → < 1788356473 1788356473
Red Hat Quay 3.9 1788595574 earliest → < 1788595574 1788595574
Red Hat Quay 3.10 1788561841 earliest → < 1788561841 1788561841
OpenShift API for Data Protection 1.5 1788860461 earliest → < 1788860461 1788860461
Red Hat Quay 3.12 1788594376 earliest → < 1788594376 1788594376
Red Hat OpenShift distributed tracing 3.11.1 1788356473 earliest → < 1788356473 1788356473

References

Timeline

  1. Published
  2. Last modified

Other CVEs of crypto/tls

The 13 CVEs of crypto/tls →
CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted… 7.5 High CVE-2026-56862 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has… 7.5 High CVE-2026-42505 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of… 5.3 Medium CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between… 9.1 Critical
Track this CVE