title: Panic on large handshake records in crypto/tls
description: Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
vendor: Go standard library
product: crypto/tls
collectionURL: https://pkg.go.dev
packageName: crypto/tls
versions:
version: 0, lessThan: 1.19.6, status: affected, versionType: semver
version: 1.20.0-0, lessThan: 1.20.1, status: affected, versionType: semver
programRoutines:
name: handshakeMessage.marshal
name: Conn.writeRecord
name: Conn.readHandshake
name: Conn.handleRenegotiation
name: Conn.handlePostHandshakeMessage
name: Conn.handleKeyUpdate
name: Conn.clientHandshake
name: Conn.loadSession
name: clientHandshakeState.handshake
name: clientHandshakeState.doFullHandshake
name: clientHandshakeState.readFinished
name: clientHandshakeState.readSessionTicket
name: clientHandshakeState.sendFinished
name: clientHandshakeStateTLS13.handshake
name: clientHandshakeStateTLS13.sendDummyChangeCipherSpec
name: clientHandshakeStateTLS13.processHelloRetryRequest
name: clientHandshakeStateTLS13.readServerParameters
name: clientHandshakeStateTLS13.readServerCertificate
name: clientHandshakeStateTLS13.readServerFinished
name: clientHandshakeStateTLS13.sendClientCertificate
name: clientHandshakeStateTLS13.sendClientFinished
name: clientHelloMsg.marshal
name: clientHelloMsg.marshalWithoutBinders
name: clientHelloMsg.updateBinders
name: serverHelloMsg.marshal
name: encryptedExtensionsMsg.marshal
name: endOfEarlyDataMsg.marshal
name: keyUpdateMsg.marshal
name: newSessionTicketMsgTLS13.marshal
name: certificateRequestMsgTLS13.marshal
name: certificateMsg.marshal
name: certificateMsgTLS13.marshal
name: serverKeyExchangeMsg.marshal
name: certificateStatusMsg.marshal
name: serverHelloDoneMsg.marshal
name: clientKeyExchangeMsg.marshal
name: finishedMsg.marshal
name: certificateRequestMsg.marshal
name: certificateVerifyMsg.marshal
name: newSessionTicketMsg.marshal
name: helloRequestMsg.marshal
name: Conn.readClientHello
name: serverHandshakeState.doResumeHandshake
name: serverHandshakeState.doFullHandshake
name: serverHandshakeState.readFinished
name: serverHandshakeState.sendSessionTicket
name: serverHandshakeState.sendFinished
name: serverHandshakeStateTLS13.checkForResumption
name: serverHandshakeStateTLS13.sendDummyChangeCipherSpec
name: serverHandshakeStateTLS13.doHelloRetryRequest
name: serverHandshakeStateTLS13.sendServerParameters
name: serverHandshakeStateTLS13.sendServerCertificate
name: serverHandshakeStateTLS13.sendServerFinished
name: serverHandshakeStateTLS13.sendSessionTickets
name: serverHandshakeStateTLS13.readClientCertificate
name: serverHandshakeStateTLS13.readClientFinished
name: cipherSuiteTLS13.expandLabel
name: sessionState.marshal
name: sessionStateTLS13.marshal
name: Conn.Handshake
name: Conn.HandshakeContext
name: Conn.Read
name: Conn.Write
name: ConnectionState.ExportKeyingMaterial
name: Dial
name: DialWithDialer
name: Dialer.Dial
name: Dialer.DialContext
defaultStatus: unaffected
}