Go crypto/tls EUVD-2026-58511

Go's standard library crypto/tls implements TLS including the TLS 1.3 post-handshake KeyUpdate message defined in RFC 8446 Section 4.6.3, which allows either peer to request an update of traffic encryption keys mid-session. The root cause (CWE-770: Allocation of Resources Without Limits or Throttling) is that the Go implementation unconditionally treats every incoming KeyUpdate as a state-advancing operation without verifying that a full handshake has been established or enforcing any rate limit or count ceiling on such messages. Each KeyUpdate triggers an HKDF-Expand-Label key derivation call, a cryptographically non-trivial operation. A single malicious client connection can therefore generate an unbounded flood of KeyUpdate records, driving continuous key derivation on the server until CPU is exhausted. Affected CPE ranges per EUVD-2026-58511 are crypto/tls 0 through <1.25.13, 1.26.0-0 through <1.26.6, and 1.27.0-0 through <1.27.0-rc.3, covering all three currently maintained Go release branches.