CVE-2022-41724 - CVE House

Back to Database

Status published High CVE-2022-41724

Panic on large handshake records in crypto/tls

7.5 CVSS

Vulnerability Description

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-41724

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Marten Seemann

References

More from Go standard library

View All →

Unexpected session resumption in crypto/tls

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Excessive CPU consumption when building archive index in archive/zip

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Affected Vendor

Go standard library

View all reports →

Affected Software

crypto/tls

Vulnerable Versions:

0, 1.20.0-0

Timeline

Official Publish: February 28th, 2023

Last Modified: March 7th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.