The vulnerability CVE-2026-32283 in the Go standard library crypto/tls package involves improper locking that can cause a deadlock when multiple TLS 1.3 key update messages are sent in a single record after the handshake. This deadlock leads to uncontrolled resource consumption and denial of service. It specifically affects TLS 1.3 connections. The issue is identified as CWE-667 (Improper Locking) and CWE-764. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). According to the Red Hat advisory, this vulnerability affects Red Hat Ansible Automation Platform 2.6 and related components that use the Go crypto/tls package. A security update addressing this issue has been released as part of Red Hat Ansible Automation Platform 2.6 updates.

Exploitation of this vulnerability can cause a denial of service by deadlocking the TLS 1.3 connection and consuming resources uncontrollably. There is no impact on confidentiality or integrity, but availability is severely affected. This can disrupt services relying on the affected Go crypto/tls implementation for TLS 1.3 connections.

A security update fixing this vulnerability is available and has been released by Red Hat for Ansible Automation Platform 2.6 and related packages. Users should apply the official patches provided by their vendor or update to fixed versions as documented in the Red Hat advisory. Since this is not a cloud service, remediation requires applying the vendor-provided update. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official fix.