{"id":"CVE-2026-78669","kind":"vulnerability","aliases":["CVE-2026-78669","GO-2026-6611"],"related":[],"title":"Excessive CPU consumption from repeated initial window changes in net/http","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","summary":"Go's net/http HTTP/2 implementation burns excessive CPU when a malicious peer opens many streams and then sends many small SETTINGS frames that change SETTINGS_INITIAL_WINDOW_SIZE. An attacker can tie up CPU on a Go HTTP/2 client or server with a modest stream of frames.","severity":"high","cvss":7.5,"epss":0.00568,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9"],"affected":"< 1.26.9","ecosystem":"go"},{"name":"stdlib","fixed":["1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"},{"name":"golang.org/x/net","fixed":["0.60.0"],"affected":"< 0.60.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","http2","kubernetes","net-http","runtime","self-hosted"],"not_affected_if":["behind-proxy-terminating-http2","http1-only","managed-hosting","no-go-http-server"],"how_to_check":"Check the Go version with 'go version' on the built binary or 'go list -m golang.org/x/net' for the x/net module; affected stdlib is below 1.26.9 or 1.27.0 through 1.27.1, and x/net is below 0.60.0.\nRun 'govulncheck ./...' in the project to confirm whether the vulnerable code is reachable.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2, and upgrade golang.org/x/net to 0.60.0, then rebuild and redeploy.\nRebuild all Go binaries after upgrading, since the stdlib fix is compiled in.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:03+00:00","updated_at":"2026-10-23T19:56:03+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:56:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2, and upgrade golang.org/x/net to 0.60.0, then rebuild and redeploy.\nRebuild all Go binaries after upgrading, since the stdlib fix is compiled in.","summary":"Go's net/http HTTP/2 implementation burns excessive CPU when a malicious peer opens many streams and then sends many small SETTINGS frames that change SETTINGS_INITIAL_WINDOW_SIZE. An attacker can tie up CPU on a Go HTTP/2 client or server with a modest stream of frames.","category":"runtime","who_cares":["go","net-http","http2","self-hosted","kubernetes"],"confidence":0.8,"analyst_note":"","how_to_check":"Check the Go version with 'go version' on the built binary or 'go list -m golang.org/x/net' for the x/net module; affected stdlib is below 1.26.9 or 1.27.0 through 1.27.1, and x/net is below 0.60.0.\nRun 'govulncheck ./...' in the project to confirm whether the vulnerable code is reachable.","needs_analyst":false,"not_affected_if":["managed-hosting","http1-only","no-go-http-server","behind-proxy-terminating-http2"],"severity_if_unknown":"high"},"cost_usd":0.000447,"input_tokens":2151,"output_tokens":464,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6611':16A '-78669':13A,19A '/x/net':24A 'attack':64B 'burn':40B 'caus':87C 'chang':8A,58B 'client':73B,93C 'consumpt':3A,90C 'contain':110C 'cpu':2A,42B,68B,89C 'cve':11A,17A 'excess':1A,41B,88C 'frame':56B,81B,109C 'go':14A,25B,35B,71B 'golang.org':23A 'golang.org/x/net':22A 'host':34B 'http':30B 'http/2':38B,72B,84C 'http2':26B 'implement':39B 'initi':6A,60B,112C 'kubernet':27B 'larg':99C 'malici':45B,83C 'mani':48B,53B,106C 'modest':78B 'net':29B 'net-http':28B 'net/http':10A,37B 'number':100C 'open':47B,97C 'peer':46B,85C 'repeat':5A 'runtim':31B 'self':33B 'self-host':32B 'send':52B,105C 'server':75B,95C 'set':55B,59B,108C,111C 'size':62B,114C 'small':54B,107C 'stdlib':20A,21A 'stream':49B,79B,102C 'tie':66B 'valu':115C 'window':7A,61B,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6611","url":"https://pkg.go.dev/vuln/GO-2026-6611","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78669","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78669","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-78669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","severity":null,"published_at":"2026-10-08T23:17:04+00:00","modified_at":"2026-10-09T17:16:49+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}