Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Go standard library net/http, net/http/internal/http2 1.26.9, 1.27.2 Clear all filters
TI-2026-69826 CVE-2026-78663

Double flow control refund on HTTP/2 server streams in net/http

Priority MEDIUM 49

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler read…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00858 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 +1 CWE-675
TI-2026-69828 CVE-2026-78669

Excessive CPU use from repeated window changes in Go net/http

Priority MEDIUM 40

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00847 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 +1 CWE-405
TI-2026-69825 CVE-2026-78660

Go net/http HTTP/2 transport accepts malformed framing headers

Priority MEDIUM 40

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00542 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 +1 CWE-444
TI-2026-69824 CVE-2026-78659

Memory exhaustion in Go net/http HTTP/2 server via Trailer headers

Priority MEDIUM 40

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00866 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 +1 CWE-405