This vulnerability (CVE-2026-32283) involves improper locking (CWE-667) in the Go standard library's crypto/tls package. Specifically, when multiple TLS 1.3 key update messages are sent in a single record post-handshake, the connection can deadlock due to locking issues. This deadlock leads to uncontrolled resource consumption and denial of service. The issue affects Go versions up to 1.26.0-0. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. No patch or official remediation level has been published yet.

The vulnerability can cause a denial of service by deadlocking TLS 1.3 connections in the Go crypto/tls package, leading to uncontrolled resource consumption. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of services using affected Go versions or implementing network-level protections to mitigate potential denial of service attempts. Monitor vendor channels for updates.