{"id":"CVE-2026-78660","kind":"vulnerability","aliases":["CVE-2026-78660","GO-2026-6610"],"related":[],"title":"HTTP/2 transport accepts malformed framing-related headers in net/http","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","summary":"Go's net/http HTTP/2 implementation accepts malformed framing-related headers and can forward them to HTTP/1 clients when acting as a reverse proxy. A downstream HTTP/1 client that parses them loosely can be tricked into response smuggling, letting an attacker desync responses.","severity":"high","cvss":7.5,"epss":0.00303,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9"],"affected":"< 1.26.9","ecosystem":"go"},{"name":"stdlib","fixed":["1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"},{"name":"golang.org/x/net","fixed":["0.60.0"],"affected":"< 0.60.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","http2","net/http","reverse-proxy","runtime"],"not_affected_if":["go-not-used","no-http2-reverse-proxy"],"how_to_check":"Check whether the Go binary's stdlib is below 1.26.9 or in 1.27.0-0 to 1.27.1 (go version -m <binary>), and whether golang.org/x/net is below 0.60.0 in go.mod or go.sum.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2, and golang.org/x/net to 0.60.0, then rebuild.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:03+00:00","updated_at":"2026-10-23T19:56:03+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:56:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2, and golang.org/x/net to 0.60.0, then rebuild.\nunknown","summary":"Go's net/http HTTP/2 implementation accepts malformed framing-related headers and can forward them to HTTP/1 clients when acting as a reverse proxy. A downstream HTTP/1 client that parses them loosely can be tricked into response smuggling, letting an attacker desync responses.","category":"runtime","who_cares":["go","reverse-proxy","net/http","http2"],"confidence":0.8,"analyst_note":"Confirm the exact affected HTTP/2 proxy conditions and any workaround in the GO-2026-6610 advisory at https://pkg.go.dev/vuln/GO-2026-6610 and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-78660.","how_to_check":"Check whether the Go binary's stdlib is below 1.26.9 or in 1.27.0-0 to 1.27.1 (go version -m <binary>), and whether golang.org/x/net is below 0.60.0 in go.mod or go.sum.\nunknown","needs_analyst":true,"not_affected_if":["no-http2-reverse-proxy","go-not-used"],"severity_if_unknown":"high"},"cost_usd":0.000453,"input_tokens":2209,"output_tokens":465,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6610':16A '-78660':13A,19A '/x/net':24A 'accept':3A,37B 'act':51B,118C 'also':127C 'attack':72B 'behav':130C 'cannot':93C 'client':49B,59B,116C,126C 'contain':110C 'cve':11A,17A 'desync':73B 'downstream':57B 'enough':132C 'forward':45B,108C 'frame':6A,40B,84C,97C 'framing-rel':5A,39B,83C 'go':14A,25B,32B 'golang.org':23A 'golang.org/x/net':22A 'header':8A,42B,86C,112C 'histor':75C 'howev':98C 'http/1':48B,58B,115C,125C 'http/2':1A,35B,89C,96C,105C 'http2':26B 'implement':36B,90C,106C 'interfer':94C 'lax':80C 'let':70B 'loos':63B 'make':100C 'malform':4A,38B,82C 'net/http':10A,27B,34B 'pars':61B 'possibl':102C 'proxi':30B,55B,122C 'rather':79C 'relat':7A,41B,85C 'respons':68B,74B,109C,137C 'result':135C 'revers':29B,54B,121C 'reverse-proxi':28B 'runtim':31B 'smuggl':69B,138C 'stdlib':20A,21A 'strict':131C 'transport':2A 'trick':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6610","url":"https://pkg.go.dev/vuln/GO-2026-6610","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78660","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78660","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-78660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","severity":null,"published_at":"2026-10-08T23:17:03+00:00","modified_at":"2026-10-09T17:16:49+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}