CVE-2026-97031

Published: Oct 8, 2026Modified: Oct 9, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

Related CWEs

CWE-405

Asymmetric Resource Consumption (Amplification)

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

References (4)

https://go.dev/cl/847312

Source: security@golang.org

https://go.dev/issue/81855

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2026-6607

Source: security@golang.org

Timeline

No history available yet.