{"id":"CVE-2026-78663","kind":"vulnerability","aliases":["CVE-2026-78663","GO-2026-6612"],"related":[],"title":"Double flow control refund on HTTP/2 server streams in net/http","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","summary":"Go's net/http HTTP/2 server refunds connection-level flow control twice for the same data when a client resets a stream and the handler later reads it. A remote client can use this to exceed the configured MaxReceiveBufferPerConnection limit and consume more server memory than intended.","severity":"critical","cvss":9.1,"epss":0.00574,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9"],"affected":"< 1.26.9","ecosystem":"go"},{"name":"stdlib","fixed":["1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"},{"name":"golang.org/x/net","fixed":["0.60.0"],"affected":"< 0.60.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","golang.org/x/net","http2-server","package","self-hosted"],"not_affected_if":["go-toolchain-already-patched","managed-hosting","no-go-http2-server"],"how_to_check":"Run `go version` on the build and runtime hosts and check whether it is below 1.26.9 or in 1.27.0 through 1.27.1; for vendored dependencies, check whether golang.org/x/net is below 0.60.0 in go.sum.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2, and upgrade golang.org/x/net to 0.60.0, then rebuild and redeploy.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:07+00:00","updated_at":"2026-10-23T19:51:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:51:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2, and upgrade golang.org/x/net to 0.60.0, then rebuild and redeploy.","summary":"Go's net/http HTTP/2 server refunds connection-level flow control twice for the same data when a client resets a stream and the handler later reads it. A remote client can use this to exceed the configured MaxReceiveBufferPerConnection limit and consume more server memory than intended.","category":"package","who_cares":["go","golang.org/x/net","self-hosted","http2-server"],"confidence":0.8,"analyst_note":"","how_to_check":"Run `go version` on the build and runtime hosts and check whether it is below 1.26.9 or in 1.27.0 through 1.27.1; for vendored dependencies, check whether golang.org/x/net is below 0.60.0 in go.sum.\nunknown","needs_analyst":false,"not_affected_if":["managed-hosting","no-go-http2-server","go-toolchain-already-patched"],"severity_if_unknown":"critical"},"cost_usd":0.000407,"input_tokens":2215,"output_tokens":371,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6612':16A '-78663':13A,19A '/x/net':24A,28B 'buffer':125C,145C 'bypass':134C 'client':54B,66B,101C,129C 'concurr':152C 'configur':73B,136C 'connect':43B,89C,138C 'connection-level':42B,88C,137C 'consum':77B 'control':3A,46B,92C,141C,160C 'cve':11A,17A 'data':51B,97C,106C,126C,146C 'doubl':1A 'exceed':71B 'exploit':131C 'flow':2A,45B,91C,140C,159C 'go':14A,25B,36B 'golang.org':23A,27B 'golang.org/x/net':22A,26B 'handler':60B,122C 'host':35B 'http/2':6A,39B,84C 'http2':30B 'http2-server':29B 'intend':82B 'later':61B 'level':44B,90C,139C,158C 'limit':75B,142C,149C,154C 'malici':128C 'maxreceivebufferperconnect':74B,143C 'memori':80B 'net/http':10A,38B 'packag':32B 'portion':113C 'read':62B,123C 'refund':4A,41B,87C,105C 'remot':65B 'request':121C 'reset':55B,102C 'self':34B 'self-host':33B 'sent':110C 'sent-but-unread':109C 'server':7A,31B,40B,79B,85C 'stdlib':20A,21A 'still':148C 'stream':8A,57B,104C,116C,153C,157C 'stream-level':156C 'total':144C 'twice':47B,93C 'unread':112C 'use':68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6612","url":"https://pkg.go.dev/vuln/GO-2026-6612","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78663","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78663","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-78663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","severity":null,"published_at":"2026-10-08T23:17:03+00:00","modified_at":"2026-10-09T17:16:49+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}