Calico Typha hangs during unclean TLS handshake
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Calico | Typha | v3.26.0 – v3.26.2; up to v3.25.1 | — | No fix listed | CNA |
| Tigera | Typha | v3.17.0 – v3.17.1; v3.16.0 – v3.16.3; up to v3.15.3 | — | No fix listed | CNA |
| — | github.com/projectcalico/calico (Go) | 3.26.0 to before 3.26.3 | 3.26.3 | Patch available | GHSA-5r5h-q934-cccp |
| — | github.com/projectcalico/calico (Go) | up to 3.25.1 | — | No fix listed | GHSA-5r5h-q934-cccp |
- Typha VendorCalico Affected v3.26.0 – v3.26.2; up to v3.25.1 Fixed in — No fix listed CNA
- Typha VendorTigera Affected v3.17.0 – v3.17.1; v3.16.0 – v3.16.3; up to v3.15.3 Fixed in — No fix listed CNA
- github.com/projectcalico/calico (Go) Vendor— Affected 3.26.0 to before 3.26.3 Fixed in 3.26.3 Patch available GHSA-5r5h-q934-cccp
- github.com/projectcalico/calico (Go) Vendor— Affected up to 3.25.1 Fixed in — No fix listed GHSA-5r5h-q934-cccp
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tigera:calico_cloud:*:*:*:*:*:*:*:* | before 18.0.0 | Vulnerable | Tigera |
| cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:* | before 3.15.4; 3.16.0 to before 3.16.4; 3.17.0 to before 3.17.2 | Vulnerable | Tigera |
| cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:* | before 3.25.2; 3.26.0 to before 3.26.3 | Vulnerable | Tigera |
- cpe:2.3:a:tigera:calico_cloud:*:*:*:*:*:*:*:* Versions before 18.0.0 Vulnerable ·Tigera
- cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:* Versions before 3.15.4; 3.16.0 to before 3.16.4; 3.17.0 to before 3.17.2 Vulnerable ·Tigera
- cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:* Versions before 3.25.2; 3.26.0 to before 3.26.3 Vulnerable ·Tigera
Remediation
- Fix · GHSA-5r5h-q934-cccp github.com/projectcalico/calico (Go) Fixed in 3.26.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-41378
- 2026-10-03 Alias added: GHSA-5r5h-q934-cccp
References
Advisory 2
Other 5
- https://github.com/projectcalico/calico/pull/7908
- https://github.com/projectcalico/calico/commit/2ebc1f92ecc39332cf1d55ba676d9101af24982f
- https://github.com/projectcalico/calico/commit/ad8bd001e650ec7742ac30e58247e7eef5956125
- https://github.com/projectcalico/calico
- https://www.tigera.io/security-bulletins-tta-2023-001
Sources
- CVE-2023-41378 · CVE Program
- CVE-2023-41378 · NVD
- FIRST EPSS
- GHSA-5r5h-q934-cccp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences