-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the readHandshake function in src/crypto/tls/conn.go. This function is responsible for reading TLS handshake messages. Before the patch, it did not properly validate the size of the handshake message declared in its header. An attacker could send a handshake message claiming to be very large. The readHandshake function would then attempt to read this declared number of bytes, potentially leading to an excessive memory allocation, which could cause a denial-of-service (panic) due to an out-of-memory error. The patch introduces a check to limit the maximum size of a handshake message, mitigating this OOM vulnerability. While other functions like Handshake, HandshakeContext, Read, Write, etc., are affected as they are part of the TLS communication flow that uses readHandshake, the core processing of the malicious input (the oversized length) happens within readHandshake.