HTTP/2 Server Vulnerability in Go Programming Language by Google
CVE-2026-78663

9.1CRITICAL

Key Information:

Vendor

Go Standard Library

Status
Net/http
Net/http/internal/http2
Golang.org/x/net/http2
Vendor
CVE Published:
8 October 2026

What is CVE-2026-78663?

A vulnerability in the Go programming language's HTTP/2 server enables a malicious client to exploit the refunding mechanism of connection-level flow control. The flaw allows a client to reset a stream and receive a refund for the sent but unread data. This process can occur twice, allowing the attacker to bypass the established connection-level flow control limits. Consequently, while total buffered data remains constrained by concurrent stream limits, this loophole poses a significant risk of resource exhaustion and server performance degradation.

Affected Version(s)

golang.org/x/net/http2 0 < 0.60.0

net/http 0 < 1.26.9

net/http/internal/http2 1.27.0-0 < 1.27.2

References

https://go.dev/cl/847187
https://go.dev/cl/847310
https://go.dev/issue/81743

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)
.