A flaw in the Go standard library TLS implementation allows a client to send repeated KeyUpdate messages even before the handshake is fully established. These messages are treated as state‑advancing and force the server to perform costly key‑derivation operations each time. The effect is that a malicious client can exhaust the server’s CPU or memory resources indefinitely, effectively disrupting service availability.

The vulnerability affects all Go runtimes that use the crypto/tls package, specifically the standard library of Go. Any application or server written in Go that enables TLS connections without an updated version is at risk.

The CVSS score is 7.5, and the EPSS score is < 1%, but the lack of mitigation allows an attacker to repeatedly issue KeyUpdate messages from a client that is able to initiate a TLS handshake. Because the vulnerability leads to uncontrolled resource consumption, the risk is considered significant for exposed services. The vulnerability is not listed in the CISA KEV catalog. No publicly disclosed exploit exists at this time, but the mechanism is straightforward enough that a custom client could trigger the denial of service.