Excessive CPU Consumption in Go HTTP/2 by Malicious Peers
CVE-2026-78669
Currently unrated
What is CVE-2026-78669?
A vulnerability in the Go HTTP/2 implementation allows a malicious peer to exploit the protocol by creating an excessive number of streams, leading to significant CPU consumption. By sending numerous SETTINGS frames with adjusted SETTINGS_INITIAL_WINDOW_SIZE values, attackers can overwhelm the server or client, resulting in degraded performance or service outages.
Affected Version(s)
golang.org/x/net/http2 0 < 0.60.0
net/http 0 < 1.26.9
net/http/internal/http2 1.27.0-0 < 1.27.2