Live › vulnerability › CVE-2026-78669
Go to dashboardGo's net/http HTTP/2 implementation burns excessive CPU when a malicious peer opens many streams and then sends many small SETTINGS frames that change SETTINGS_INITIAL_WINDOW_SIZE. An attacker can tie up CPU on a Go HTTP/2 client or server with a modest stream of frames.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | < 1.26.9 | 1.26.9 |
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.27.2 |
| golang.org/x/net | go | < 0.60.0 | 0.60.0 |
go version on the built binary or go list -m golang.org/x/net for the x/net module; affected stdlib is below 1.26.9 or 1.27.0 through , and x/net is below 1.27.10.60.0govulncheck ./... in the project to confirm whether the vulnerable code is reachable1.26.9 or 1.27.2, and upgrade golang.org/x/net to 0.60.0, then rebuild and redeployEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
This page as .md · .json · in your agent: get_signal("CVE-2026-78669")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.