Golang.Org X Net Golang.Org X Net Http2 vulnerabilities

CVE-2023-45288 [HIGH] CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an exce An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are st

CVE-2026-78663 [CRITICAL] CWE-675 CVE-2026-78663: The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a clie The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceive

CVE-2026-78659 [HIGH] CWE-405 CVE-2026-78659: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to po When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of field

CVE-2026-27141 [HIGH] CWE-476 CVE-2026-27141: Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

CVE-2026-33814 [HIGH] CWE-835 CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATIO When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVE-2026-78669 [HIGH] CWE-405 CVE-2026-78669: A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a lar A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

CVE-2026-78660 [HIGH] CWE-444 CVE-2026-78660: Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implemen Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behav

CVE-2026-97032 [HIGH] CWE-362 CVE-2026-97032: HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a

CVE-2022-41717 [MEDIUM] CWE-770 CVE-2022-41717: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 serve An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.