CVE-2026-97032
published 2026-10-08CVE-2026-97032: HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.49%
41.8th percentile
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| etcd | etcd | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | net_http | < 1.26.9 | 1.26.9 |
| go_standard_library | net_http_internal_http2 | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| golang.org | x_net_golang.org_x_net_http2 | < 0.60.0 | 0.60.0 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| jetbrains | toolbox | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Go http2 HPACK encoder race condition (ID 847188 / EUVD-2026-95429)
vuldb·2026-10-09
CVE-2026-97032 [LOW] Go http2 HPACK encoder race condition (ID 847188 / EUVD-2026-95429)
A vulnerability, which was classified as problematic, was found in Go http2. This vulnerability affects unknown code of the component HPACK encoder. The manipulation results in race condition.
This vulnerability is cataloged as CVE-2026-97032. The attack may be launched remotely. There is no exploit available.
Applying a patch is advised to resolve this issue.
Red Hat
net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification
vendor_redhat·2026-10-08·CVSS 5.9
CVE-2026-97032 [MEDIUM] CWE-366 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification
net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification
A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.
Package: helm (OpenShift Developer Tools and Services) - Out of support scope
Package: openshift-pipelines-client (OpenShift Pipelines) - Fix deferred
Package: k
No detection rules found.
No public exploits indexed.
2026-10-08
Published