{"record":{"id":"64cf369657430401","repo":"golang/go","slug":"tls-malformed-encrypted-client-hello-extension","errorCode":null,"errorMessage":"tls: malformed encrypted_client_hello extension","messagePattern":"tls: malformed encrypted_client_hello extension","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/ech.go","lineNumber":496,"sourceCode":"\t}\n\treturn true\n}\n\n// ECHRejectionError is the error type returned when ECH is rejected by a remote\n// server. If the server offered a ECHConfigList to use for retries, the\n// RetryConfigList field will contain this list.\n//\n// The client may treat an ECHRejectionError with an empty set of RetryConfigs\n// as a secure signal from the server.\ntype ECHRejectionError struct {\n\tRetryConfigList []byte\n}\n\nfunc (e *ECHRejectionError) Error() string {\n\treturn \"tls: server rejected ECH\"\n}\n\nvar errMalformedECHExt = errors.New(\"tls: malformed encrypted_client_hello extension\")\nvar errInvalidECHExt = errors.New(\"tls: client sent invalid encrypted_client_hello extension\")\n\ntype echExtType uint8\n\nconst (\n\tinnerECHExt echExtType = 1\n\touterECHExt echExtType = 0\n)\n\nfunc parseECHExt(ext []byte) (echType echExtType, cs echCipher, configID uint8, encap []byte, payload []byte, err error) {\n\tdata := make([]byte, len(ext))\n\tcopy(data, ext)\n\ts := cryptobyte.String(data)\n\tvar echInt uint8\n\tif !s.ReadUint8(&echInt) {\n\t\terr = errMalformedECHExt\n\t\treturn\n\t}","sourceCodeStart":478,"sourceCodeEnd":514,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/ech.go#L478-L514","documentation":"Thrown by parseECHExt when the encrypted_client_hello extension in the outer ClientHello is structurally malformed. The extension must contain: a type byte (0 for outer, 1 for inner), and for outer type: KDF ID (uint16), AEAD ID (uint16), config ID (uint8), uint16-length-prefixed encapsulated key, and uint16-length-prefixed encrypted payload. For inner type, no additional data is allowed. Any truncated field, incorrect length prefix, or unexpected trailing data triggers this error. Note: processECHClientHello wraps this into errInvalidECHExt and sends a decode error alert before returning to the caller.","triggerScenarios":"The outer ClientHello's encrypted_client_hello extension is too short to contain the required fields, has incorrect length prefixes for the encapsulated key or encrypted payload, the inner-type variant has unexpected trailing bytes, or the outer-type variant is missing the KDF ID, AEAD ID, config ID, enc, or payload fields.","commonSituations":"A non-compliant or buggy client sends a malformed ECH extension with truncated fields. A middlebox or TLS-terminating proxy corrupts the extension bytes. The client uses an incompatible ECH draft version with a different extension wire format than RFC 9460. A deliberate fuzzing or attack attempt sending garbage in the ECH extension.","solutions":["Ensure the client sends a properly formatted ECH extension following the RFC 9460 wire format: type(1) + KDF(2) + AEAD(2) + configID(1) + enc(2-length-prefixed) + payload(2-length-prefixed)","Verify no TLS-intermediating device (proxy, WAF, load balancer) is modifying handshake packets","Confirm client and server use compatible ECH specification versions (RFC 9460 final vs. older drafts)","Use network packet capture (tcpdump/Wireshark) to verify the extension bytes on the wire"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"// parseECHExt errors are wrapped by processECHClientHello:\n//   - errMalformedECHExt → alertDecodeError → returns errInvalidECHExt\n//   - errInvalidECHExt  → alertIllegalParameter → returns errInvalidECHExt\n//\n// if errors.Is(err, errInvalidECHExt) {\n//     // client sent malformed or invalid ECH extension\n// }","preventionTips":["Ensure clients use RFC 9460-compliant ECH extension encoding","Verify no middlebox modifies TLS handshake packets","Monitor for decode error alerts as indicators of client compatibility issues"],"tags":["tls","ech","server-side","handshake","parsing","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}