VDB
CVE-2026-97031
CVE-2026-97031
PUBLISHED
CVSS 7.5 HIGH
Reported by Go · Published October 8, 2026
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/tls | 0, 1.27.0-0 |
| chainguard | k8ssandra-client | 0 |
| chainguard | prometheus-elasticsearch-exporter-fips | 0 |
| chainguard | frankenphp-8.4 | 0 |
| chainguard | crossplane-provider-aws-dynamodb-fips | 0 |
| chainguard | promxy-fips | 0 |
| chainguard | rancher-security-scan-0.6 | * |
| chainguard | flux-fips-2.7 | 0 |
| chainguard | terraform-provider-acme-fips | 0 |
| wolfi | pgpool2_exporter | 0 |
| chainguard | kubernetes-fips-1.33 | 0 |
| chainguard | loki-2.9 | 0 |
| chainguard | zarf | 0 |
| chainguard | cert-manager-1.21 | 0 |
| chainguard | longhorn-engine-1.10 | 0 |
| wolfi | pluto | 0 |
| chainguard | dcgm-exporter-fips | 0 |
| chainguard | cortex-fips | 0 |
| chainguard | crossplane-provider-gitlab-fips | 0 |
| chainguard | gogatekeeper | 0 |
…and 2388 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Security Advisory