What’s Vulnerable › Vulnerabilities

CVE-2022-41724: Panic on large handshake records in crypto/tls

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-28 · updated 2026-06-17
• Weakness: CWE-400

Description

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

Affected products

• Go: before 1.19.6; 1.20.0, 1.20.0-rc1, 1.20.0-rc2, 1.20.0-rc3 — fixed in 1.19.6

How to fix

Upgrade to a fixed version: Go 1.19.6. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/468125
• https://go.dev/issue/58001
• https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
• https://pkg.go.dev/vuln/GO-2023-1570
• https://security.gentoo.org/glsa/202311-09
• https://go.dev/cl/468125
• https://go.dev/issue/58001
• https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
• https://pkg.go.dev/vuln/GO-2023-1570
• https://security.gentoo.org/glsa/202311-09

Get alerted when CVE-2022-41724 or the next vulnerability affects your stack