AZL-96668

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96668.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-96668

Upstream

CVE-2026-56862

Published

2026-08-13T22:17:22Z

Modified

2026-09-01T05:28:09Z

Summary

CVE-2026-56862 affecting package golang 1.26.5-2

Details

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-56862

Affected packages

Azure Linux:3 / golang

Package

Name: golang
Purl: pkg:rpm/azure-linux/golang

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.26.0

Last affected

1.26.5-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96668.json"