Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.10 bsc1255111: CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. CVE-2026-111943:...

OPENSUSE-SU-2026:22152-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. - CVE-2026-111943:...

SUSE-SU-2026:24359-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. - CVE-2026-111943:...

AZL-107276 CVE-2026-78663 affecting package coredns 1.11.4-21

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-78663

The HTTP/2 server is vulnerable to a flaw where it can refund connection-level flow control twice for the same data. This occurs when a client resets a stream (refunding sent-but-unread data) and again when a request handler reads the buffered data. An attacker can exploit this to bypass the MaxR...

CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...