CVE-2026-97031: Reject malformed ECH outer extension references in crypto/tls
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this memory-exhaustion risk?
Servers using the affected Google Go crypto/tls implementation and accepting TLS client connections are the relevant exposure point. The issue is triggered by malformed client packets containing multiple ECH outer extension references.
What must an attacker be able to do to exploit this?
An attacker needs to send a well-crafted TLS packet to the server. The packet specifies multiple ECH outer extension references, which are prohibited by RFC 9849 and can amplify memory consumption.
How can I tell whether attempted exploitation is occurring?
The provided information identifies malformed TLS client packets with multiple ECH outer extension references as the trigger. It does not provide log signatures, detection guidance, or other indicators for identifying attempts.