CVE-2026-97031
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Oct 8, 2026
CISA due date
—
The record
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by… CWE-405
- CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the header… CWE-405
- CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should… CWE-405
- CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS… CWE-405
- CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. CWE-405
- CVE-2026-54874 Issue summary: Receiving a DTLS record for a future epoch while a handshake is in… CWE-405
- CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend… CWE-405
- CVE-2026-72914 Mastodon is a free, open-source social network server based on ActivityPub. CWE-405