Threats Tagged 'ghsa-hq7w-2xrq-wp2j'

CVE-2026-97031 is a high-severity vulnerability in the Go standard library's crypto/tls package. It involves improper handling of multiple Encrypted Client Hello (ECH) outer extension references, which are disallowed by RFC 9849. A malicious client could send a crafted packet with multiple references, causing memory exhaustion on the server. The issue has been addressed by rejecting such malformed packets, mitigating the memory amplification risk.