GO-2026-6607

vendorUSosv

Reject malformed ECH outer extension references in crypto/tls

view advisory published 2026-10-08Licence: per source

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-97031US	—	0.52% (44th)	—	2026-10-08
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server p…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/847312FIX
https://go.dev/issue/81855REPORT
https://groups.google.com/g/golang-announce/c/U2fTuyDJznIWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan