CVE-2026-97031: 
Go 脆弱性分析と緩和策

CVE-2026-97031 is a Denial of Service vulnerability in Go's crypto/tls standard library package, caused by improper handling of multiple ECH (Encrypted Client Hello) outer extension references during TLS handshakes. RFC 9849 prohibits multiple ECH outer extension references, but prior to the fix, a remote unauthenticated attacker could send a well-crafted packet specifying multiple such references, triggering memory exhaustion in the server process. The vulnerability affects Go versions before 1.26.9 and versions 1.27.0-0 through 1.27.2. It was published on October 8, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Github Advisory).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-405 (Asymmetric Resource Consumption / Amplification). The Go crypto/tls implementation previously did not validate that ECH outer extension references appeared only once per TLS ClientHello, as required by RFC 9849. An attacker could craft a TLS handshake packet containing multiple ECH outer extension references, causing the server to repeatedly copy outer extensions and exhaust available memory — a classic amplification pattern where minimal attacker input produces disproportionate server-side resource consumption. The fix rejects such packets as malformed before the amplification can occur (Red Hat Bugzilla, Go Issue).

Successful exploitation results in memory exhaustion of the affected server process, leading to a denial of service condition. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Any Go-based server application using the crypto/tls package with ECH support enabled and exposed to network traffic is at risk, including web servers, API gateways, and other TLS-terminating services built with affected Go versions (Github Advisory, Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time (Github Advisory). The vulnerability is rated automatable (no user interaction or privileges required), making it straightforward to exploit at scale against exposed services. The EPSS score is approximately 0.179–0.394%, placing it in the lower-to-mid range of exploitation likelihood within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Red Hat Advisory).

1. Reconnaissance: Identify internet-facing services built with Go's crypto/tls that support ECH (Encrypted Client Hello), using tools like Shodan, Censys, or ZGrab2 to scan for TLS services and banner-grab Go version information.
2. Craft malicious ClientHello: Construct a TLS ClientHello packet that includes multiple ECH outer extension references in violation of RFC 9849. This can be done using low-level TLS packet crafting libraries (e.g., Python's scapy with TLS extensions, or a custom Go client).
3. Send packet to target: Transmit the malformed ClientHello to the target server's TLS port (typically 443). No authentication or prior session is required.
4. Trigger memory amplification: The vulnerable server processes the multiple ECH outer extension references, copying outer extensions repeatedly and consuming server memory without bound.
5. Achieve denial of service: Repeated or sustained sending of such packets exhausts server memory, causing the server process to crash or become unresponsive (Red Hat Bugzilla, Go Issue).

• Network: Unusual volume of TLS ClientHello packets from a single or distributed source IP(s) targeting TLS-enabled ports; ClientHello packets with anomalous or repeated ECH extension fields detectable via deep packet inspection or TLS-aware IDS rules.
• Logs: Server-side TLS handshake errors or abrupt connection resets logged in application or system logs; Go runtime out-of-memory (OOM) errors or panic messages in application logs referencing crypto/tls.
• Process: Rapid or sustained growth in memory usage of the Go server process (observable via top, htop, or monitoring tools like Prometheus); OOM killer events in system logs (dmesg or /var/log/syslog) terminating the Go server process.

Upgrade to Go 1.26.9 or Go 1.27.2 (or later), which reject malformed ECH outer extension references before memory amplification can occur (Red Hat Bugzilla, Go Vulnerability DB). As a temporary workaround, consider placing a TLS-terminating reverse proxy (e.g., nginx, HAProxy) in front of Go-based services to filter malformed TLS handshakes before they reach the vulnerable application. Additionally, rate-limiting incoming TLS connections at the network or firewall level can reduce the impact of exploitation attempts. SUSE has also released updated packages (SUSE-SU-2026:4625-1 and SUSE-SU-2026:4629-1) for affected distributions (SUSE Advisory).

The vulnerability was announced via the golang-announce mailing list and tracked under Go vulnerability identifier GO-2026-6607. Red Hat assigned it high severity and opened a Bugzilla tracking entry with a broad CC list of 76 product security engineers, indicating wide internal impact assessment across Red Hat's Go-based product portfolio. Microsoft also acknowledged the CVE in its October 2026 Patch Tuesday advisory cycle. Security vendors including Tenable (Nessus, cloud, and container security plugins) and Qualys have released detection plugins for the vulnerability (Red Hat Bugzilla, Microsoft MSRC).