CVE-2026-97031: go standard library crypto/tls

CVSS: 7.5v3.1HighAwaiting analysis

AliasesUBUNTU-CVE-2026-97031DEBIAN-CVE-2026-97031CGA-222w-fg62-4x4c+8828 more

Published 08-10-2026Last modified 09-10-2026

Vulnerability summary

CVE-2026-97031 is a high (CVSS 7.5) vulnerability in go standard library crypto/tls. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.39%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 9

MGASA-2026-0497 OPENSUSE-SU-2026:12093-1 OPENSUSE-SU-2026:12101-1 OPENSUSE-SU-2026:12112-1 OPENSUSE-SU-2026:22093-1 OPENSUSE-SU-2026:22095-1+4 more

Timeline

08-10-2026
PublishedVulnerability first disclosed.
09-10-2026
Last modifiedVulnerability information updated.

Description

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

Change unavailable

09-10-202622-10-2026

EPSS score

0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Affected systems

Chainguard200 products

aactl< 0.4.12-r79
access-log-exporter-fips< 0.4.22-r1
acm-controller-fips< 1.10.0-r1
actions-runner-controller< 0.15.0-r1
actions-runner-controller-fips< 0.15.0-r1

addon-resizer< 1.8.24-r7
addon-resizer-fips< 1.8.24-r7
ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)
agentbeat-fips< 9.2.7-r30
agentbeat-fips-8.19< 8.19.23-r1
alloydb-auth-proxy-fips< 1.17.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300074.0-r2
amazon-cloudwatch-agent-operator-fips< 3.7.0-r8
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agent-fips< 1.108.0-r1
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260617-r8
amazon-eks-ami-fips< 20261003-r1
amazon-k8s-cni-fips< 1.23.2-r1 | All versions (No fix recorded)
amazon-k8s-cni-init-fips< 1.23.2-r1
amazon-k8s-cni-init-fips-compat< 1.23.2-r2 | All versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fips< 3.3.5512.0-r1
amazon-ssm-agent-fips< 3.3.5512.0-r1
amazon-vpc-cni-plugins< 1.3_git20260618-r8
amazon-vpc-cni-plugins-fips< 1.3_git20260619-r10
ansible-operator-fips< 1.42.3-r17
apache-beam-java-11-sdkAll versions (No fix recorded)
apache-beam-java-17-sdkAll versions (No fix recorded)
apache-beam-java-21-sdkAll versions (No fix recorded)
apache-beam-python-3.11-sdkAll versions (No fix recorded)
apache-beam-python-3.14-sdkAll versions (No fix recorded)
apache-exporter< 1.1.1-r7
api-linterAll versions (No fix recorded)
apiserver-network-proxy-fips-0.34All versions (No fix recorded) | < 0.34.0-r15
apiserver-network-proxy-fips-0.34-agent< 0.34.0-r15
apiserver-network-proxy-fips-0.35< 0.35.0-r15 | All versions (No fix recorded)
apiserver-network-proxy-fips-0.35-agent< 0.35.0-r15
apiserver-network-proxy-fips-0.36< 0.36.0-r15
apiserver-network-proxy-fips-0.36-agentAll versions (No fix recorded) | < 0.36.0-r15
apiserver-network-proxy-fips-0.37< 0.37.0-r3
apiserver-network-proxy-fips-0.37-agent< 0.37.0-r3
apko-fips< 1.4.10-r1
apm-server-fips-8.19< 8.19.23-r2
apm-server-fips-9.2< 9.2.8-r17
apm-server-fips-9.3< 9.3.8-r9
apm-server-fips-9.4< 9.4.8-r2 | < 9.4.8-r3
apm-server-fips-9.5< 9.5.5-r2
application-gateway-kubernetes-ingress-fips< 1.9.14-r1
argo-cd-3.3< 3.3.15-r1
argo-cd-3.3-compat< 3.3.15-r1
argo-cd-3.4< 3.4.10-r1
argo-cd-3.4-compat< 3.4.10-r1
argo-cd-fips-3.1All versions (No fix recorded) | < 3.1.16-r16
argo-cd-fips-3.1-compat< 3.1.16-r16
argo-cd-fips-3.2< 3.2.12-r27
argo-cd-fips-3.2-compat< 3.2.12-r27
argo-cd-fips-3.3< 3.3.15-r1
argo-cd-fips-3.3-compat< 3.3.15-r1
argo-cd-fips-3.4< 3.4.10-r1
argo-cd-fips-3.4-compat< 3.4.10-r1
argo-cd-fips-3.5< 3.5.4-r1
argo-cd-fips-3.5-compat< 3.5.4-r1
argo-events-fips< 1.9.11-r15
argo-rollouts-fips< 1.10.0-r4
argo-workflow-controller-3.7< 3.7.18-r10
argo-workflow-controller-4.0< 4.0.12-r2
argo-workflow-controller-4.1< 4.1.4-r2
argo-workflow-controller-fips-3.7< 3.7.18-r10
argo-workflow-controller-fips-4.0< 4.0.13-r1
argo-workflow-controller-fips-4.1< 4.1.4-r1 | All versions (No fix recorded)
argo-workflow-executor-3.7< 3.7.18-r10
argo-workflow-executor-4.1< 4.1.5-r0
argo-workflow-executor-fips-3.7< 3.7.18-r10
argo-workflow-executor-fips-4.0< 4.0.13-r1
argo-workflow-executor-fips-4.1< 4.1.5-r0
argo-workflows-3.7< 3.7.18-r10
argo-workflows-4.0< 4.0.12-r2
argo-workflows-4.1< 4.1.4-r2
argo-workflows-fips-3.7< 3.7.18-r10
argo-workflows-fips-4.0< 4.0.13-r1
argo-workflows-fips-4.1< 4.1.5-r0 | < 4.1.4-r1
argocd-image-updater-fips< 1.3.1-r1
athenz-cert-manager-issuer-fips< 0.0.9-r4
athenz-csi-driver-fips< 0.0.16-r9
athenz-csi-driver-fips-approver< 0.0.16-r9
atlantis< 0.48.1-r1
atlantis-fips< 0.48.1-r2
atlas< 1.3.0-r9
atlas-fips< 1.3.0-r11
auditbeat-9.3< 9.3.8-r17
auditbeat-fips-8.19< 8.19.23-r1
auditbeat-fips-9.2< 9.2.8-r25
auditbeat-fips-9.3< 9.3.8-r12
auditbeat-fips-9.4< 9.4.8-r1
auditbeat-fips-9.5< 9.5.5-r2
authentik-2026.5-go-server< 2026.5.7-r10
authentik-fips-2025.12-go-server< 2025.12.6-r19
authentik-fips-2026.2-go-server< 2026.2.7-r6
authentik-fips-2026.5-go-server< 2026.5.7-r12
authservice< 1.1.8-r6
authservice-fips< 1.1.8-r7
avmfixAll versions (No fix recorded)
avmfix-fipsAll versions (No fix recorded)
aws-application-networking-k8s< 2.1.3-r5
aws-application-networking-k8s-fips< 2.1.3-r3
aws-ebs-csi-driver-1.58< 1.58.0-r15
aws-ebs-csi-driver-1.60< 1.60.1-r14
aws-ebs-csi-driver-1.61< 1.61.1-r10
aws-ebs-csi-driver-1.62< 1.62.0-r9
aws-ebs-csi-driver-1.63< 1.63.1-r8
aws-ebs-csi-driver-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.57< 1.57.1-r20 | < 1.57.1-r21
aws-ebs-csi-driver-fips-1.58< 1.58.0-r16
aws-ebs-csi-driver-fips-1.59< 1.59.0-r17
aws-ebs-csi-driver-fips-1.60< 1.60.1-r16
aws-ebs-csi-driver-fips-1.61< 1.61.1-r12
aws-ebs-csi-driver-fips-1.62< 1.62.0-r13
aws-ebs-csi-driver-fips-1.63< 1.63.1-r7
aws-ebs-csi-driver-fips-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.65< 1.65.0-r4
aws-ebs-csi-driver-fips-1.66< 1.66.1-r1
aws-efs-csi-driver-fips< 3.5.1-r3
aws-eks-pod-identity-agent-fips< 0.2.5-r1
aws-flb-cloudwatch< 1.9.5-r10
aws-flb-cloudwatch-fips< 1.9.5-r10
aws-flb-firehose< 1.7.3-r13
aws-flb-firehose-fips< 1.7.3-r11
aws-flb-kinesis-fips< 1.10.4-r9 | < 1.10.4-r8
aws-for-fluent-bit-init-fips< 3.5.0-r1
aws-fsx-csi-driver-fips< 1.11.0-r1
aws-iam-authenticator-fips< 0.7.20-r5
aws-lambda-runtime-interface-emulator-fips< 1.37-r3
aws-load-balancer-controller-fips< 3.6.0-r1
aws-network-policy-agent< 1.4.3-r1
aws-network-policy-agent-fips< 1.4.3-r1
aws-node-termination-handler< 1.25.6-r21
aws-node-termination-handler-fips< 1.25.6-r21
aws-nuke< 3.68.3-r1
aws-nuke-fips< 3.68.3-r1
aws-otel-collector< 0.50.0-r6
aws-otel-collector-fips< 0.50.0-r7
aws-otel-collector-healthcheck< 0.50.0-r6
aws-otel-collector-healthcheck-fips< 0.50.0-r7
aws-privateca-issuer-fips< 1.10.0-r1
aws-signer-notation-plugin-fips< 1.0.2292-r24 | < 1.0.2292-r23
aws-sigv4-proxy-fips< 1.13.1-r0
azcopy-fipsAll versions (No fix recorded) | < 10.32.8-r4
azure-metrics-exporter< 25.12.0-r7
azure-metrics-exporter-fips< 25.12.0-r3
azure-service-operator< 2.21.1-r2
azure-service-operator-fips< 2.21.1-r2
azure-vnet-cni< 1.9.2-r2
azuredisk-csi-1.34< 1.34.7-r1
azuredisk-csi-1.35< 1.35.0-r1
azuredisk-csi-fips-1.33< 1.33.13-r1
azuredisk-csi-fips-1.34< 1.34.7-r1
azuredisk-csi-fips-1.35< 1.35.0-r1
azuredisk-csi-fips-1.36< 1.36.0-r1
azurefile-csi-1.33< 1.33.10-r12
azurefile-csi-fips-1.33< 1.33.10-r14
azurefile-csi-fips-1.34< 1.34.10-r1
azurefile-csi-fips-1.35< 1.35.10-r1
backup-restore-operator-10.0< 10.0.10-r1
backup-restore-operator-8.1< 8.1.9-r2
backup-restore-operator-fips-10.0< 10.0.10-r1
backup-restore-operator-fips-11.0< 11.0.3-r1
backup-restore-operator-fips-7.0< 7.0.11-r1
backup-restore-operator-fips-8.1< 8.1.9-r1
backup-restore-operator-fips-9.0< 9.0.8-r1
bank-vaults< 1.33.2-r5
bank-vaults-fips< 1.33.2-r6
bank-vaults-template< 1.33.2-r5
bank-vaults-template-fips< 1.33.2-r6
bank-vaults-vault-operator-fips< 1.24.1-r1
bento-fips< 1.22.0-r1
blob-csi-1.23< 1.23.11-r86
blob-csi-1.24< 1.24.11-r35
blob-csi-1.25< 1.25.10-r33
blob-csi-1.26< 1.26.17-r2
blob-csi-1.27< 1.27.11-r1
blob-csi-fips-1.23< 1.23.11-r90
blob-csi-fips-1.24< 1.24.11-r37
blob-csi-fips-1.25< 1.25.10-r31
blob-csi-fips-1.26< 1.26.17-r3
blob-csi-fips-1.27< 1.27.11-r1
blobfuse2-fips< 2.4.2-r24
blobfuse2-fips-health-monitorAll versions (No fix recorded)
bom< 0.8.0-r2
boring-registry-fips< 0.19.0-r9
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildah-fips< 1.45.1-r3
buildctl-fips< 0.34.0-r1
buildkitd-fips< 0.34.0-r1
buildkite-agent-3< 3.138.0-r1
buildkite-agent-fips-3< 3.138.0-r1
buildkite-agent-fips-4< 4.3.0-r1
buildtools-buildifier-fipsAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 4065. Use Open JSON for the complete list.

References

9 links

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities