CVE-2026-56853

CVE-2026-56853 affects the Go net/http server when configured for unencrypted HTTP/2. The issue is that ReadHeaderTimeout is not applied while reading the initial connection bytes to detect the HTTP/2 client preface. This can allow the initial handshake path to bypass the intended header read tim...

PT-2026-71895

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

Denial Of Service (DoS)

knative.dev/eventing-gitlab is vulnerable to Denial of Service DoS. The vulnerability is due to improper enforcement of the ReadHeaderTimeout which is used to timeout individual read operations in receiveadapter.go. This can lead to a Denial Of Service, making the server unavailable to other user...

eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

GHSA-V7HC-87JC-QRRR eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations

Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...