Memory Exhaustion Vulnerability in Go Programming Language
CVE-2026-97031

7.5HIGH

Key Information:

Vendor: Go Standard Library
Status: Crypto/tls
Vendor: CVE Published:; 8 October 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-97031?

This vulnerability arises from multiple outer extension references being incorrectly handled, allowing clients to manipulate packet structures in a way that leads to memory exhaustion on the server side. Previously, a well-structured malicious packet could exploit this loophole, resulting in server process interruptions. With the latest updates, any such references are now identified as malformed and thereby mitigated, effectively reducing the risk of memory amplification attacks in Go-based environments.

Affected Version(s)

crypto/tls 0 < 1.26.9

crypto/tls 1.27.0-0 < 1.27.2

References

https://go.dev/cl/847312

https://go.dev/issue/81855

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 8, 2026
Vulnerability Reserved
Sep 23, 2026

CVE-2026-97031 Data

JSON