CVE-2026-97031

A flaw was found in Go's crypto/tls package. When processing Encrypted Client Hello ECH extensions, the server fails to reject multiple outer extension references as required by the protocol specification. A remote attacker can exploit this vulnerability by sending a specially crafted handshake...