CVE-2026-78663
published 2026-10-08CVE-2026-78663: The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
0.62%
49.5th percentile
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| etcd | etcd | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | net_http | < 1.26.9 | 1.26.9 |
| go_standard_library | net_http_internal_http2 | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| golang.org | x_net_golang.org_x_net_http2 | < 0.60.0 | 0.60.0 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| jetbrains | toolbox | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vendor_redhat9.1CRITICAL
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Go vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 7.5
CVE-2026-56866 [HIGH] Go vulnerabilities
Title: Go vulnerabilities
Summary: Several security issues were fixed in Go.
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovere
Red Hat
net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server
vendor_redhat·2026-10-08·CVSS 9.1
CVE-2026-78663 [CRITICAL] CWE-770 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server
net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server
A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service (DoS). This issue occurs because the server improperly refunds flow control credits twice for the same data: once when a client resets a stream, and again when the application reads the buffered data. Consequently, a malicious client can exceed configured connection buffer limits.
Statement: Red Hat has evaluated this vulnerability as having a Moderate security impact because, while remote unauthenticated clients can
VulDB
Go net http internal http2 x net http2 HTTP/2 Server Flow Control multiple operations on resource in single-operation context (ID 847187 / EUVD-2026-95427)
vuldb·2026-10-09·CVSS 9.1
CVE-2026-78663 [CRITICAL] Go net http internal http2 x net http2 HTTP/2 Server Flow Control multiple operations on resource in single-operation context (ID 847187 / EUVD-2026-95427)
A vulnerability, which was classified as problematic, was found in Go net http internal http2 x net http2. Affected by this vulnerability is an unknown functionality of the component HTTP2 Server Flow Control. Executing a manipulation can lead to multiple operations on resource in single-operation context.
This vulnerability is registered as CVE-2026-78663. It is possible to launch the attack remotely. No exploit is available.
A patch should be applied to remediate this issue.
No detection rules found.
No public exploits indexed.
2026-10-08
Published