Channel-based deadlock vulnerability in Go mux by Google

CVE-2026-78662

What is CVE-2026-78662?

A vulnerability exists in Google's Go mux that allows a malicious peer to flood channel incoming requests, potentially causing a deadlock in the connection. By introducing an atomic established state, the updated system ensures channels are unusable until they are properly established. During this state, the handlePacket function will drop any packets except for open confirmation or failure, effectively preventing blocking and preserving connection integrity.

References