Panic on large handshake records in crypto/tls
Priority MEDIUM 41CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 22 fixed, 27 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01111 66th percentileScored 2026-11-07
Fix Partial crypto/tls (Go standard library): 1.19.6, 1.20.1Red Hat: 32 advisoriesRed Hat: 22 fixed, 27 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | crypto/tls | before 1.19.6; 1.20.0-0 to before 1.20.1 | 1.19.6, 1.20.1 | Patch available | CNA |
- crypto/tls VendorGo standard library Affected before 1.19.6; 1.20.0-0 to before 1.20.1 Fixed in 1.19.6, 1.20.1 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.19.6 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.20.0:-:*:*:*:*:*:* | 1.20.0 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.20.0:rc1:*:*:*:*:*:* | 1.20.0 rc1 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.20.0:rc2:*:*:*:*:*:* | 1.20.0 rc2 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.20.0:rc3:*:*:*:*:*:* | 1.20.0 rc3 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.19.6 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.20.0:-:*:*:*:*:*:* Versions 1.20.0 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.20.0:rc1:*:*:*:*:*:* Versions 1.20.0 rc1 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.20.0:rc2:*:*:*:*:*:* Versions 1.20.0 rc2 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.20.0:rc3:*:*:*:*:*:* Versions 1.20.0 rc3 Vulnerable ·Go standard library
Remediation
- Fix · CNA crypto/tls (Go standard library) Fixed in 1.19.6, 1.20.1
Red Hat 32 advisories
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
- RHSA-2023:7672 Released 2023-12-06 · Red Hat rating ModerateOpenShift Virtualization 4.14.1 RPMs security and bug fix update
- CNV 4.14 for RHEL 8 kubevirt-4.14.1-2150.el8, kubevirt-virtctl-4.14.1-2150.el8, kubevirt-virtctl-redistributable-4.14.1-2150.el8
- RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
Show 29 more Red Hat advisories
- RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
- RHSA-2023:6817 Released 2023-11-08 · Red Hat rating ImportantOpenShift Virtualization 4.14.0 Images security and bug fix update
- CNV 4.14 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +37
- RHSA-2023:6402 Released 2023-11-07 · Red Hat rating Moderatecontainernetworking-plugins security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-4.el9
- RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderatepodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
- RHSA-2023:6380 Released 2023-11-07 · Red Hat rating Moderaterunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.9-1.el9
- RHSA-2023:6473 Released 2023-11-07 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-1.el9, buildah-tests-1:1.31.3-1.el9
- RHSA-2023:6363 Released 2023-11-07 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-1.el9, skopeo-tests-2:1.13.3-1.el9
- RHSA-2023:5976 Released 2023-10-20 · Red Hat rating ImportantService Telemetry Framework 1.5.2 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/prometheus-webhook-snmp-rhel8, stf/service-telemetry-operator-bundle, stf/service-telemetry-rhel8-operator +4
- RHSA-2023:5964 Released 2023-10-20 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2.5 (collectd-libpod-stats) security update
- Red Hat OpenStack Platform 16.2 collectd-libpod-stats-1.0.4-5.el8ost
- RHSA-2023:5935 Released 2023-10-19 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2.5 security update
- Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
- RHSA-2023:4470 Released 2023-08-03 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3612 Released 2023-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.13.4 packages and security update
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.18.1.el9_2, buildah-1:1.29.1-2.1.rhaos4.13.el9, buildah-1:1.29.1-2.rhaos4.13.el8 +47
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2023:3366 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.2 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-api-1:21.3.1-0.20230510075528.b3c902e.el9, openstack-ironic-common-1:21.3.1-0.20230510075528.b3c902e.el9 +3
- Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.16.1.el9_2, buildah-1:1.29.1-1.1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.1.rhaos4.13.el9 +47
- RHSA-2023:3455 Released 2023-06-05 · Red Hat rating ModerateRelease of OpenShift Serverless 1.29.0
- Red Hat OpenShift Serverless 1.29 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:3445 Released 2023-06-05 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-14.el8ost
- RHSA-2023:3450 Released 2023-06-05 · Red Hat rating ModerateOpenShift Serverless Client kn 1.29.0 release
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.8.1-3.el8
- RHSA-2023:3303 Released 2023-05-30 · Red Hat rating ModerateOpenShift Container Platform 4.13.1 packages and security update
- Red Hat OpenShift Container Platform 4.13 cri-o-1.26.3-6.rhaos4.13.gitb3475fb.el8, cri-o-1.26.3-7.rhaos4.13.gitb3475fb.el9
- RHSA-2023:0584 Released 2023-05-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:3167 Released 2023-05-18 · Red Hat rating ModerateRed Hat build of Cryostat 2.3.0: new RHEL 8 container images
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
- RHSA-2023:1329 Released 2023-05-18 · Red Hat rating ModerateOpenShift Container Platform 4.13.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 microshift-4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9, microshift-greenboot-4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9, microshift-networking-4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9 +2
- RHSA-2023:1325 Released 2023-05-18 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
- Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
- RHSA-2023:1326 Released 2023-05-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.0 security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:3083 Released 2023-05-16 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.6-1.module+el8.8.0+18289+edd6c8b6.aarch64::go-toolset:rhel8 +18
- RHSA-2023:2107 Released 2023-05-04 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.9 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-velero-plugin-rhel8
- RHSA-2023:1817 Released 2023-04-18 · Red Hat rating ModerateNetwork observability 1.2.0 for Openshift
- NETOBSERV 1.2 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +1
- RHSA-2023:1639 Released 2023-04-05 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.3 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-velero-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-MTV-2.4 | Fixed | — |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:1639 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:2107 |
| CNV 4.14 for RHEL 8 | Fixed | RHSA-2023:7672 |
| CNV 4.14 for RHEL 9 | Fixed | RHSA-2023:6817 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2023:3167 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| NETOBSERV 1.2 for RHEL 9 | Fixed | RHSA-2023:1817 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:0584 |
| Quay v3 | Fixed | — |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| Red Hat Ansible Automation Platform 2.3 for RHEL 8 | Fixed | RHSA-2023:4470 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:3083, RHSA-2023:6938, RHSA-2023:6939 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6363, RHSA-2023:6380, RHSA-2023:6402, RHSA-2023:6473, RHSA-2023:6474 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:1325, RHSA-2023:1326, RHSA-2023:1329, RHSA-2023:3303, RHSA-2023:3366, RHSA-2023:3612 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:3450 |
| Red Hat OpenShift Serverless 1.29 | Fixed | RHSA-2023:3455 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:3445, RHSA-2023:5935, RHSA-2023:5964 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:5976 |
Not affected: 24 products
- 8Base-MTV-2.4
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.14 for RHEL 9
- Custom Metric Autoscaler operator for Red Hat Openshift
- Ironic content for Red Hat OpenShift Container Platform 4.13
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- Middleware Containers for OpenShift
- NETOBSERV 1.2 for RHEL 9
- OSSO 1.1 for RHEL 8
- RHODF 4.13 for RHEL 9
- Red Hat Advanced Cluster Security 3
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.0
- Red Hat Satellite 6
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41724
- 2026-10-03 Alias added: GHSA-89mw-w342-mqrr
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-41724 · CVE Program
- CVE-2022-41724 · NVD
- FIRST EPSS
- GHSA-89mw-w342-mqrr · GitHub Advisory Database · CC BY 4.0
- CVE-2022-41724 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences