crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3

[nicholashusin]

Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.

Thanks to Qi Deng of Aurascape.ai for reporting this issue.

This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.

---

This was a PUBLIC track issue, tracked in http://b/515061449.

[gopherbot]

Change https://go.dev/cl/804261 mentions this issue: crypto/tls: do not count handshake messages as state-advancing post-handshake

[gabyhelp]

Related Issues

• crypto/tls: TLS 1.3 post-handshake messages can bypass non-advancing record limit #79866
• crypto/tls: initial handshake messages can include additional messages in TLS 1.3 #76443 (closed)
• crypto/tls: multiple key update handshake messages can cause connection to deadlock #78334 (closed)

Related Code Changes

• crypto/tls: do not count handshake messages as state-advancing post-handshake

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[nicholashusin]

@gopherbot Please open backport for this security issue.

[gopherbot]

Backport issue(s) opened: #80530 (for 1.25), #80531 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[dmitshur]

@nicholashusin Please be aware that without a milestone set, the release-blocker label doesn't block any particular Go release.

[nicholashusin]

Ack, thanks @dmitshur . Seems like the playbook on the security side might need updating. I'll send you a CL for it.

[gopherbot]

Change https://go.dev/cl/806841 mentions this issue: [release-branch.go1.27] crypto/tls: do not count handshake messages as state-advancing post-handshake

[gopherbot]

Change https://go.dev/cl/806960 mentions this issue: [release-branch.go1.25] crypto/tls: do not count handshake messages as state-advancing post-handshake