{"record":{"id":"35d69b40b3692f4d","repo":"golang/go","slug":"tls-received-malformed-key-share-extension","errorCode":null,"errorMessage":"tls: received malformed key_share extension","messagePattern":"tls: received malformed key_share extension","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":306,"sourceCode":"\t\tc.sendAlert(alertUnsupportedExtension)\n\t\treturn errors.New(\"tls: unexpected encrypted client hello extension in serverHello\")\n\t}\n\n\t// The only HelloRetryRequest extensions we support are key_share and\n\t// cookie, and clients must abort the handshake if the HRR would not result\n\t// in any change in the ClientHello.\n\tif hs.serverHello.selectedGroup == 0 && hs.serverHello.cookie == nil {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: server sent an unnecessary HelloRetryRequest message\")\n\t}\n\n\tif hs.serverHello.cookie != nil {\n\t\thello.cookie = hs.serverHello.cookie\n\t}\n\n\tif hs.serverHello.serverShare.group != 0 {\n\t\tc.sendAlert(alertDecodeError)\n\t\treturn errors.New(\"tls: received malformed key_share extension\")\n\t}\n\n\t// If the server sent a key_share extension selecting a group, ensure it's\n\t// a group we advertised but did not send a key share for, and send a key\n\t// share for it this time.\n\tif curveID := hs.serverHello.selectedGroup; curveID != 0 {\n\t\tif !slices.Contains(hello.supportedCurves, curveID) {\n\t\t\tc.sendAlert(alertIllegalParameter)\n\t\t\treturn errors.New(\"tls: server selected unsupported group\")\n\t\t}\n\t\tif slices.ContainsFunc(hs.hello.keyShares, func(ks keyShare) bool {\n\t\t\treturn ks.group == curveID\n\t\t}) {\n\t\t\tc.sendAlert(alertIllegalParameter)\n\t\t\treturn errors.New(\"tls: server sent an unnecessary HelloRetryRequest key_share\")\n\t\t}\n\t\tke, err := keyExchangeForCurveID(curveID)\n\t\tif err != nil {","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L288-L324","documentation":"Thrown during HelloRetryRequest processing when the server's key_share extension includes a server_share with a non-zero group. In a HelloRetryRequest, the server should use the selected_group field to request a different key share from the client — including an actual server share is malformed.","triggerScenarios":"Triggered when hs.serverHello.serverShare.group != 0 during HRR processing. The client sends alertDecodeError. The server incorrectly included a key share (its own public key) in the HRR instead of just selecting a group.","commonSituations":"Server bug: including a server key share in the HelloRetryRequest extension instead of using the selected_group field. Non-compliant TLS 1.3 server implementation that confuses the HRR key_share format with the regular ServerHello format.","solutions":["Server should use the key_share selected_group field in HelloRetryRequest, not the server_share entry.","Report as a server-side TLS 1.3 implementation bug.","If the server cannot be fixed, restrict client to TLS 1.2.","Verify with an alternative TLS client (e.g. openssl) to confirm it is a server issue."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := tls.Dial(\"tcp\", addr, config)\nif err != nil {\n    if strings.Contains(err.Error(), \"malformed key_share extension\") {\n        // Server bug in HRR key_share — fall back to TLS 1.2\n        config.MaxVersion = tls.VersionTLS12\n        conn, err = tls.Dial(\"tcp\", addr, config)\n    }\n}","preventionTips":["Capture HRR messages with Wireshark to verify key_share format.","Report malformed HRR key_share bugs to server vendors.","Test HRR by offering only key shares the server doesn't initially accept."],"tags":["tls","go","tls13","key-share","hello-retry-request","malformed"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}