CVE-2026-56862

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-568647.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor CVE-2026-568658.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an CVE-2026-568667.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without fra CVE-2026-56878.8A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStati CVE-2026-568768.1extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a CVE-2026-568776.3The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter a CVE-2026-568796.7In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of p CVE-2026-56887.3A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bi CVE-2026-568818.4In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of CVE-2026-568828.8In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution wit CVE-2026-568886.2In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation CVE-2026-568896.7In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege wi