{"id":"CVE-2026-78659","kind":"vulnerability","aliases":["CVE-2026-78659","GO-2026-6603"],"related":[],"title":"HTTP/2 server memory exhaustion due to Trailer headers in net/http","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","summary":"A malicious client can send an HTTP/2 request with a Trailer header that declares a very large number of fields, making a Go net/http server allocate a disproportionate amount of memory. An attacker can exhaust server memory and cause denial of service, bypassing the header count and size limits.","severity":"high","cvss":7.5,"epss":0.0057,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9"],"affected":"< 1.26.9","ecosystem":"go"},{"name":"stdlib","fixed":["1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"},{"name":"golang.org/x/net","fixed":["0.60.0"],"affected":"< 0.60.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","go-services","golang.org/x/net","http2","runtime","self-hosted"],"not_affected_if":["behind-proxy-stripping-trailers","go-version-patched","http1-only"],"how_to_check":"Run go version on the build or host and compare against the affected ranges: stdlib below 1.26.9, or 1.27.0 through 1.27.1.\nCheck go.mod or the lockfile for golang.org/x/net below 0.60.0.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the server binaries.\nUpgrade golang.org/x/net to 0.60.0 and rebuild.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:07+00:00","updated_at":"2026-10-23T19:56:07+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:56:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the server binaries.\nUpgrade golang.org/x/net to 0.60.0 and rebuild.","summary":"A malicious client can send an HTTP/2 request with a Trailer header that declares a very large number of fields, making a Go net/http server allocate a disproportionate amount of memory. An attacker can exhaust server memory and cause denial of service, bypassing the header count and size limits.","category":"runtime","who_cares":["go","golang.org/x/net","http2","self-hosted","go-services"],"confidence":0.8,"analyst_note":"","how_to_check":"Run go version on the build or host and compare against the affected ranges: stdlib below 1.26.9, or 1.27.0 through 1.27.1.\nCheck go.mod or the lockfile for golang.org/x/net below 0.60.0.\nunknown for whether a specific deployment is reachable over HTTP/2 without a proxy.","needs_analyst":false,"not_affected_if":["http1-only","behind-proxy-stripping-trailers","go-version-patched"],"severity_if_unknown":"high"},"cost_usd":0.000434,"input_tokens":2312,"output_tokens":406,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6603':16A '-78659':13A,19A '/x/net':24A,31B 'alloc':62B,147C 'amount':65B,150C 'applic':163C 'attack':69B 'bypass':79B,154C 'calcul':185C 'caus':75B,143C 'client':39B,93C,127C 'connect':180C 'count':82B 'cve':11A,17A 'declar':50B,137C 'denial':76B 'differ':186C 'disproportion':64B,149C 'due':5A 'entri':118C 'exhaust':4A,71B 'exploit':129C,160C 'field':56B,142C 'go':14A,25B,27B,59B 'go-servic':26B 'golang.org':23A,30B 'golang.org/x/net':22A,29B 'handler':111C 'header':8A,48B,81B,88C,100C,135C 'host':36B 'http':95C 'http/1':165C 'http/2':1A,43B,123C 'http2':32B 'incur':119C 'intern':97C 'larg':53B,139C,173C 'limit':85B,158C 'make':57B 'malici':38B,126C 'map':106C,116C 'memori':3A,67B,73B,120C,152C 'multiplex':171C 'net/http':10A,60B 'number':54B,140C,174C 'one':178C 'overhead':121C 'pass':107C 'popul':103C 'request':44B,176C 'request.trailer':105C,113C 'runtim':33B 'self':35B 'self-host':34B 'send':41B,132C 'sent':90C 'server':2A,61B,72B,96C,110C,124C,145C,166C 'server.maxheaderbytes':157C,183C 'server.maxheadervaluecount':155C 'servic':28B,78B 'size':84B 'stdlib':20A,21A 'support':170C 'tcp':179C 'trailer':7A,47B,87C,134C 'use':98C 'valu':101C 'whose':182C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6603","url":"https://pkg.go.dev/vuln/GO-2026-6603","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78659","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78659","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-78659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","severity":null,"published_at":"2026-10-08T23:17:03+00:00","modified_at":"2026-10-09T16:35:35+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}