Live › vulnerability › CVE-2026-97032
Go to dashboardGo's standard net/http HTTP/2 server can crash because it modifies the HPACK encoder from two goroutines without synchronization when a client changes the header table size. A remote client can repeatedly trigger the race to crash the server, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | < 1.26.9 | 1.26.9 |
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.27.2 |
| golang.org/x/net | go | < 0.60.0 | 0.60.0 |
Run go version on the build host and on the server binary's Go toolchain; affected if stdlib is below 1.26.9 or in 1.27.0 to before 1.27.2. For x/net, check go.mod for golang.org/x/net below 0.60.0.
Upgrade the Go toolchain to or and rebuild; for golang.org/x/net, update to or later and rebuild.
1.26.91.27.20.60.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-97032")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.