{"cve":"CVE-2022-41724","nvd":{"published":"2023-02-28T18:15:10.043","modified":"2026-06-17T05:03:43.110","status":"Modified","description":"Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://go.dev/cl/468125","https://go.dev/issue/58001","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://pkg.go.dev/vuln/GO-2023-1570","https://security.gentoo.org/glsa/202311-09"],"products":["golang:go"],"source":"nvd","synced_at":"2026-10-19T21:37:41.955480748+00:00"},"epss":{"cve":"CVE-2022-41724","score":0.01111,"percentile":0.65948,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GO-2023-1570","url":"https://osv.dev/vulnerability/GO-2023-1570","summary":"Panic on large handshake records in crypto/tls","modified":"2026-02-04T02:57:33.465285Z","packages":[{"ecosystem":"Go","name":"stdlib","purl":"pkg:golang/stdlib","ranges":["<1.19.6",">=1.20.0-0 <1.20.1"],"fixed":["1.19.6","1.20.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}