HIGH7.5
GO-2026-6607
Reject malformed ECH outer extension references in crypto/tls
Quick fix
GO-2026-6607 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.26.9Details
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
We now reject these as malformed and curb the memory amplification vector as a result.
Are you affected?
Enter the version of the package you're using.