CVE-2026-56862

CVE-2026-56862 affects the Go crypto/tls implementation: KeyUpdate/handshake messages are treated as state-advancing even after handshake, allowing a malicious client to trigger repeated key derivations. The connected CVE record notes this is due to post-handshake handshake messages, and the CVE ...