net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities

The version of Golang running on the remote host is 1.25.x prior to 1.25.13, or 1.26.x prior to 1.26.6. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory. - The ToASCII and ToUnicode functions incorrectl...

Linux Distros Unpatched Vulnerability : CVE-2026-56853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

DEBIAN-CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

UBUNTU-CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2019-10070

creationtimestamp| type| source ---|---|--- 2026-08-13 22:00:03+00:00| seen| https://t.me/GithubRedTeam/97947 2026-08-14 00:00:07+00:00| seen| https://t.me/GithubRedTeam/97947...

CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-56853

Technical details about CVE-2026-56853 are not publicly available in the provided documents; monitor for updates.

CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

GO-2026-6089 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

Denial of Service (DoS)

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain th...

Moderate: Red Hat Security Advisory: nghttp2 security update

An update for nghttp2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-48937

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources. Mitigation Restrict Node.js HTTP/2 servers to trusted clients with host firewall or network segmentation. If HTTP/2 is not required, disable...

org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...