CVE-2026-97031 Reject malformed ECH outer extension references in crypto/tls
A remote attacker can cause server memory exhaustion and denial of service by sending malformed ECH outer extension references in TLS handshakes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97031?
CVE-2026-97031 is a high-severity denial of service vulnerability in Go standard library crypto/tls, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Weakness: CWE-405
Which versions are affected by CVE-2026-97031?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.26.9, 1.27.2 |
stdlib Go | All versions | 1.26.9, 1.27.2 |
Linux distribution packages (1)
mihomo openSUSE:Tumbleweed | All versions | 1.19.33-1.1 |
How do I fix CVE-2026-97031?
Upgrade golang to a fixed version for your release line: 1.26.9 or 1.27.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97031 being exploited?
There is no known exploitation of CVE-2026-97031 in the wild and no public exploit code.
Sources
Also known as AZL-107475, AZL-107487, BELL-CVE-2026-97031, BIT-golang-2026-97031, CLEANSTART-2026-AO15558, CLEANSTART-2026-CX91057 and 2205 more.