CVE-2026-97031: CWE-405: Asymmetric Resource Consumption in Go standard library crypto/tls
Description
CVE-2026-97031 is a vulnerability in the Go standard library's crypto/tls package involving asymmetric resource consumption. It arises from allowing multiple ECH outer extension references, which is disallowed by RFC 9849. A client could previously send a crafted packet with multiple references, causing memory exhaustion on the server. The issue is now mitigated by rejecting such malformed packets, preventing memory amplification.
Affected software
Go standard library
crypto/tls
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves the Go standard library's crypto/tls package where multiple Encrypted ClientHello (ECH) outer extension references were permitted, violating RFC 9849. An attacker could exploit this by sending a specially crafted packet containing multiple ECH references, leading to excessive memory consumption on the server, effectively a denial-of-service via resource exhaustion. The fix involves rejecting packets with multiple ECH outer extension references as malformed, thereby curbing the memory amplification vector.
Potential Impact
The impact is a potential denial-of-service condition caused by memory exhaustion on the server processing TLS connections with malformed ECH extension packets. This could degrade or disrupt service availability but does not indicate code execution or data compromise.
Mitigation Recommendations
A fix is available in Go standard library versions 1.26.9 and 1.27.2 and later, which reject malformed packets with multiple ECH outer extension references. Users should upgrade to these or later versions to mitigate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Go
- Date Reserved
- 2026-09-23T23:03:36.988Z
- State
- PUBLISHED
Threat ID: 6ac821662cdf04f65641721b
Added to database: 10/08/2026, 23:04:06 UTC
Last enriched: 10/08/2026, 23:18:51 UTC
Last updated: 10/08/2026, 23:19:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.