Non notée
CVE-2022-41724 Large handshake records may cause panics in crypto/tls
Description
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| crypto/tls 1.20 | 1.20.0-0 → < 1.20.1 | 1.20.1 |
| crypto/tls 1.19 | premières → < 1.19.6 | 1.19.6 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- security.gentoo.org security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de crypto/tls
Les 13 CVE de crypto/tls →
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted…
7.5
Élevée
CVE-2026-56862
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has…
7.5
Élevée
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of…
5.3
Moyenne
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…
7.5
Élevée