CVE-2026-56853

CVE-2026-56853 affects the Go net/http server when configured for unencrypted HTTP/2. The issue is that ReadHeaderTimeout is not applied while reading the initial connection bytes to detect the HTTP/2 client preface. This can allow the initial handshake path to bypass the intended header read tim...