Reject malformed ECH outer extension references in crypto/tls

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97031 · Microsoft / collected KEV context

EUVD-2026-95422

GHSA-hq7w-2xrq-wp2j

GO-2026-6607

BIT-golang-2026-97031

cve-program · CVE-2026-97031

• https://go.dev/cl/847312
• https://go.dev/issue/81855
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://pkg.go.dev/vuln/GO-2026-6607

euvd · EUVD-2026-95422

• https://go.dev/cl/847312
• https://go.dev/issue/81855
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://pkg.go.dev/vuln/GO-2026-6607

nvd · CVE-2026-97031

• https://go.dev/cl/847312
• https://go.dev/issue/81855
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://pkg.go.dev/vuln/GO-2026-6607

osv · GO-2026-6607

• https://go.dev/cl/847312
• https://go.dev/issue/81855
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

• Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject thes… · Advisory content revised · 7 Nov 2026
• Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject thes… · Advisory content revised · 5 Nov 2026
• Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject thes… · Advisory content revised · 1 Nov 2026
• Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject thes… · Advisory content revised · 30 Oct 2026