CVE-2026-97031

A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can trigger memory exhaustion and crash server processes without requiring privileges or user interaction. Go applications that terminate TLS connections and accept Encrypted Client Hello configurations are vulnerable to resource amplification during the initial handshake. While the flaw does not facilitate arbitrary code execution or compromise data confidentiality, the resulting denial of service can disrupt critical network services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.