| Package | Affected versions | Patched versions |
|---|---|---|
| stdlib | ≥ 1.27.0-0, < 1.27.2< 1.26.9 | 1.27.21.26.9 |
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
We now reject these as malformed and curb the memory amplification vector as a result.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free