From 6db0b2d9de82ed4ba0688bc68612a9313f9d5514 Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Thu, 10 Sep 2026 23:26:52 -0400 Subject: [PATCH] crypto/tls: do not count handshake messages as state-advancing post-handshake Previously, we always counted handshake messages, such as KeyUpdate, as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. Fix the issue by making it so that handshake messages are regarded as state-advancing only prior to handshake completion. Thank you to Qi Deng of Aurascape.ai for reporting this issue. Fixes #79866 Fixes #80528 Fixes CVE-2026-56862 Change-Id: I37d27fd5f16227a9dde5f29bb5ae6c436a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/804261 Reviewed-by: Roland Shoemaker Reviewed-by: Neal Patel LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com Reviewed-by: Neal Patel --- conn.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conn.go b/conn.go index d75b48d..2cb3f80 100644 --- a/conn.go +++ b/conn.go @@ -732,7 +732,7 @@ func (c *Conn) readRecordOrCCS(expectChangeCipherSpec bool) error { return c.in.setErrorLocked(c.sendAlert(alertUnexpectedMessage)) } - if typ != recordTypeAlert && typ != recordTypeChangeCipherSpec && len(data) > 0 { + if (typ == recordTypeApplicationData || (typ == recordTypeHandshake && !handshakeComplete)) && len(data) > 0 { // This is a state-advancing message: reset the retry count. c.retryCount = 0 }