Answer in brief
CVE-2026-97031 records a High severity (CVSS 7.5) vulnerability in Reject malformed ECH outer extension references in crypto/tls. The current sources do not mark it as known exploited. The current feed maps Go standard library/crypto/tls (generic), stdlib (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Go standard library/crypto/tls (generic), stdlib (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Go standard library/crypto/tlsgeneric | >=0 <1.26.9 || >=1.27.0-0 <1.27.2 | 1.26.9, 1.27.2 |
| stdlibgo | >=0 <1.26.9 >=1.27.0-0 <1.27.2 | 1.26.9, 1.27.2 |
Published upstream
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 8, 2026
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Quoted source text, attributed separately from HOL analysis.