CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

[
  {
    "vendor": "Go standard library",
    "product": "crypto/tls",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "crypto/tls",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.25.9",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.26.0-0",
        "lessThan": "1.26.2",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Conn.handleKeyUpdate"
      },
      {
        "name": "clientHandshakeStateTLS13.establishHandshakeKeys"
      },
      {
        "name": "clientHandshakeStateTLS13.readServerFinished"
      },
      {
        "name": "serverHandshakeStateTLS13.sendServerParameters"
      },
      {
        "name": "serverHandshakeStateTLS13.readClientFinished"
      },
      {
        "name": "Conn.Handshake"
      },
      {
        "name": "Conn.HandshakeContext"
      },
      {
        "name": "Conn.Read"
      },
      {
        "name": "Conn.Write"
      },
      {
        "name": "Dial"
      },
      {
        "name": "DialWithDialer"
      },
      {
        "name": "Dialer.Dial"
      },
      {
        "name": "Dialer.DialContext"
      },
      {
        "name": "QUICConn.HandleData"
      },
      {
        "name": "QUICConn.Start"
      }
    ],
    "defaultStatus": "unaffected"
  }
]