CLEANSTART-2026-HG56934: Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...
Security vulnerability affects the trust-manager package. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote client can exploit it by sending a well-crafted packet containing multiple ECH outer extension references. No user interaction or prior privileges are required.
What is the impact of successful exploitation?
Successful exploitation can exhaust memory in the server process, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.
How can I determine whether my deployment is exposed?
Deployments using the cleanstart/trust-manager package are affected by this vulnerability. The supplied data does not identify affected or fixed package versions, configuration prerequisites, or a detection method.