State-Advancing Vulnerability in Go Language Server Product

CVE-2026-56862

What is CVE-2026-56862?

This vulnerability in the Go programming language allows a malicious client to exploit the KeyUpdate handshake messages. The issue arises because the server treats these messages as state-advancing, which means it continues key derivation operations indefinitely, even before the handshake process is completed. This can potentially create a denial of service, as the server resources are continuously engaged in unnecessary processing. Developers using the affected versions should patch this vulnerability to ensure their applications are secure.

References