CVE-2026-78663

The HTTP/2 server is vulnerable to a flaw where it can refund connection-level flow control twice for the same data. This occurs when a client resets a stream (refunding sent-but-unread data) and again when a request handler reads the buffered data. An attacker can exploit this to bypass the MaxR...

CVE-2026-78669

A malicious HTTP/2 peer can trigger excessive CPU consumption in a client or server by opening numerous streams and transmitting many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. This vulnerability impacts several packages, including loki , cloud-sql-proxy , kube-bench , ...

CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

CVE-2026-56866

The http.Transport component is vulnerable to a desynchronization issue when handling HTTP/1 CONNECT requests with a non-empty Request.Body . The underlying cause is that the transport writes the body directly to the connection without framing; if a server rejects the request with a non-2xx keep-...

CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78659

An HTTP server is vulnerable to an asymmetric resource consumption attack via HTTP/2 "Trailer" headers. A malicious client can send a large number of fields within a "Trailer" header, forcing the server to allocate a disproportionate amount of memory because the Request.Trailer map incurs memory ...

CVE-2026-94440

Parsing a multipart form can bypass memory limits and allow an attacker to read an arbitrarily long line into memory. This occurs specifically when the remaining limit at the start of a part is less than 400 bytes . The vulnerability is associated with CWE-770 (Allocation of Resources Without Lim...

GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

GO-2026-6603 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

GO-2026-6617 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

GO-2026-6605 HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

GO-2026-6613 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...