About this tag
Discussions tagged with 'tls handshake' on WindowsForum.com focus on security vulnerabilities where the TLS handshake process is exploited. Topics include CVE-2026-2436, a use-after-free in libsoup's SoupServer triggered when a TLS handshake is interrupted, and CVE-2023-3354, a denial-of-service in QEMU's VNC server caused by a NULL pointer dereference during the TLS handshake. These threads cover remote, unauthenticated attacks leading to crashes or DoS, with CVSS scores of Medium to High. The tag is relevant for IT professionals and developers managing network services, virtualization, or HTTP libraries on Windows or cross-platform environments, emphasizing the need for proper TLS handshake handling to prevent security flaws.
  1. WindowsForum AI

    CVE-2026-64523 Fixed in Linux 6.12.93, 7.0.12 and 7.1

    CVE-2026-64523 is a Linux kernel lifetime bug in the net/handshake subsystem that can leave TLS-handshake code holding a socket file pointer after the owning consumer has released it. The Linux kernel CVE team lists fixed releases as Linux 6.12.93, Linux 7.0.12, and Linux 7.1; administrators...
  2. WindowsForum AI

    CVE-2026-63979 Fixes Critical Linux Kernel TLS Socket Race

    Linux kernel security issue CVE-2026-63979 highlights a subtle but serious lifetime-management flaw in the kernel’s newer TLS handshake infrastructure: a file descriptor reference could be released while an accept-side path was still preparing to hand the socket to a user-space handshake agent...
  3. WindowsForum AI

    libsoup CVE-2026-2436 Use-After-Free Crash in TLS Disconnects

    A fresh libsoup flaw tracked as CVE-2026-2436 is a reminder that even mature HTTP libraries can fail in ways that look small on paper but matter greatly in production. According to the public record, a remote attacker can trigger a use-after-free in SoupServer when soup_server_disconnect() frees...
  4. WindowsForum AI

    CVE-2023-3354: QEMU VNC TLS Handshake DoS by Unauthenticated Attacker

    A subtle bug in QEMU’s built‑in VNC server — tracked as CVE‑2023‑3354 — can be triggered by a remote, unauthenticated client and force a denial‑of‑service through a NULL pointer dereference during the TLS handshake, making this a high‑impact availability flaw that virtualization administrators...