CVE-2026-32283 is a denial of service vulnerability in the Go standard library's crypto/tls package specifically affecting TLS 1.3 connections. The flaw occurs when one side of a TLS connection sends multiple key update messages in a single record post-handshake, which can cause the connection to deadlock and consume resources uncontrollably. This vulnerability is tracked under CWE-667 (Improper Locking) and CWE-764 (Multiple Locks of a Critical Resource). The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and an availability impact. Red Hat has acknowledged this vulnerability affecting their products that use the Go crypto/tls library and has released security advisories and patches for affected versions.

Exploitation of this vulnerability allows a remote attacker to cause a denial of service by triggering a deadlock in TLS 1.3 connections, leading to uncontrolled consumption of system resources. There is no impact on confidentiality or integrity. The vulnerability can disrupt availability of services relying on the affected Go crypto/tls implementation.

A fix is available. Red Hat has released security updates for affected products including Red Hat Ansible Automation Platform 2.6 and related components. Users should apply the provided patches or upgrade to fixed versions as per the vendor advisories. No additional mitigations are specified or required beyond applying the official fixes.