All vulnerabilities
CVE-2026-97031

Reject malformed ECH outer extension references in crypto/tls

Go standard library crypto/tls
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.26.9Also 1.27.2CVE List
Published8 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

Text from CVE List

Affected versions 2

  • crypto/tlsaffected: all versions before 1.26.9CVE List
  • crypto/tlsaffected: 1.27.0-0 before 1.27.2CVE List

References 4