Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Go standard library crypto/tls unaffected
Version Status Constraints
0 affected < 1.26.9
1.27.0-0 affected < 1.27.2

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Go Standard Library Subscribe
Crypto Tls Subscribe

Project Subscriptions

Vendors Products
Go Standard Library Subscribe
Crypto Tls Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://go.dev/cl/847312 cve-icon cve-icon cve-icon
https://go.dev/issue/81855 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-97031 cve-icon
https://pkg.go.dev/vuln/GO-2026-6607 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-97031 cve-icon
History

Fri, 09 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 09 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library crypto Tls
Vendors & Products Go Standard Library
Go Standard Library crypto Tls

Fri, 09 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Thu, 08 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Title Reject malformed ECH outer extension references in crypto/tls
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-10-08T22:53:58.775Z

Reserved: 2026-09-23T23:03:36.988Z

Link: CVE-2026-97031

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-08T23:17:06.037

Modified: 2026-10-08T23:17:06.037

Link: CVE-2026-97031

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-08T22:53:58Z

Links: CVE-2026-97031 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T03:45:16Z

Weaknesses