Memory Exhaustion Vulnerability in Go Programming Language

CVE-2026-97031

What is CVE-2026-97031?

This vulnerability arises from multiple outer extension references being incorrectly handled, allowing clients to manipulate packet structures in a way that leads to memory exhaustion on the server side. Previously, a well-structured malicious packet could exploit this loophole, resulting in server process interruptions. With the latest updates, any such references are now identified as malformed and thereby mitigated, effectively reducing the risk of memory amplification attacks in Go-based environments.

References