CVE-2026-97031
EPSS 0.5%Pure vendor patch announcement recycling; no PoC, exploitation, or independent confirmation.
What: TLS Encrypted Client Hello (ECH) memory exhaustion in RFC 9849 implementations; multiple outer extension references trigger DoS via memory amplification.
Why it matters: Low EPSS (0.32%) and no KEV listing suggest limited real-world traction. Chatter is exclusively vendor patch announcements (Google Apigee v1.15.9, Oct 21) bundling CVE-2026-97031 with 30+ other CVEs in routine security updates. No PoC, exploitation reports, or defender triage visible.
Where it's seen: Bulk vendor advisory cross-posting on Bluesky listing CVE-2026-97031 alongside unrelated vulnerabilities across Apigee components (runtime, Redis, watcher, kube-rbac-proxy, fluent-bit). Pattern indicates automated security digest, not focused incident response.
RISK: LOW — ECH is niche TLS extension; low EPSS and no KEV indicate minimal exploitation likelihood currently.
Description
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.