CVE-2026-97031
published 2026-10-08CVE-2026-97031: Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.39%
32.4th percentile
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| etcd | etcd | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | crypto_tls | < 1.26.9 | 1.26.9 |
| go_standard_library | crypto_tls | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| jetbrains | toolbox | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
| redhat | openshift | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
vendor_redhat·2026-10-08·CVSS 7.5
CVE-2026-97031 [HIGH] CWE-770 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
A flaw was found in Go's crypto/tls package. When processing Encrypted Client Hello (ECH) extensions, the server fails to reject multiple outer extension references as required by the protocol specification. A remote attacker can exploit this vulnerability by sending a specially crafted handshake message, triggering memory amplification that leads to process memory exhaustion and a Denial of Service (DoS).
Package: helm (OpenShift Developer Tools and Services) - Affected
Package: openshift-pipelines-client (OpenShift Pipelines) - Affected
Package: kn-workflow-plugin (OpenShift Serverless) - Affected
Package: openshift-serverless-clients (OpenShift Serverless) - Affected
Package: istio-proxy
VulDB
Google crypto tls up to 1.26.8/1.27.1 Packet amplification (EUVD-2026-95422)
vuldb·2026-10-09·CVSS 7.5
CVE-2026-97031 [HIGH] Google crypto tls up to 1.26.8/1.27.1 Packet amplification (EUVD-2026-95422)
A vulnerability was found in Google crypto tls up to 1.26.8/1.27.1 and classified as problematic. Impacted is an unknown function of the component Packet Handler. Such manipulation leads to asymmetric resource consumption.
This vulnerability is documented as CVE-2026-97031. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying
ghsa_unreviewed·2026-10-09
CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
No detection rules found.
No public exploits indexed.
2026-10-08
Published