UNKNOWN Go
Reject malformed ECH outer extension references in crypto/tls
GO-2026-6607 · BIT-golang-2026-97031 · CVE-2026-97031
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
We now reject these as malformed and curb the memory amplification vector as a result.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes