Go TLS Library Multiple Key Update Messages Can Cause Deadlock Vulnerability

A denial-of-service vulnerability has been identified in the Go programming language's standard library, specifically within the TLS (Transport Layer Security) implementation. This issue arises in TLS 1.3 when one side of the connection sends multiple key update messages after the handshake, all within a single record. Such a scenario can lead to a deadlock, causing uncontrolled resource consumption.

Impact

Exploitation of this vulnerability can result in a denial-of-service condition, where the affected TLS connection becomes unresponsive, leading to resource exhaustion.

Remediation

This vulnerability has been fixed in Go versions 1.26.2 and 1.25.9. Users can download these versions from the Go website or via the Go Update Tool.