{"id":"CVE-2026-97032","kind":"vulnerability","aliases":["CVE-2026-97032","GO-2026-6617"],"related":[],"title":"HTTP/2 server crash due to HPACK encoder race in net/http","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","summary":"Go's standard net/http HTTP/2 server can crash because it modifies the HPACK encoder from two goroutines without synchronization when a client changes the header table size. A remote client can repeatedly trigger the race to crash the server, a denial of service.","severity":"high","cvss":7.5,"epss":0.0042,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9"],"affected":"< 1.26.9","ecosystem":"go"},{"name":"stdlib","fixed":["1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"},{"name":"golang.org/x/net","fixed":["0.60.0"],"affected":"< 0.60.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","golang.org/x/net","http2","net/http","runtime","self-hosted"],"not_affected_if":["http1-only","managed-hosting"],"how_to_check":"Run `go version` on the build host and on the server binary's Go toolchain; affected if stdlib is below 1.26.9 or in 1.27.0 to before 1.27.2. For x/net, check go.mod for golang.org/x/net below 0.60.0.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild; for golang.org/x/net, update to 0.60.0 or later and rebuild.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:06+00:00","updated_at":"2026-10-23T19:56:06+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:56:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild; for golang.org/x/net, update to 0.60.0 or later and rebuild.","summary":"Go's standard net/http HTTP/2 server can crash because it modifies the HPACK encoder from two goroutines without synchronization when a client changes the header table size. A remote client can repeatedly trigger the race to crash the server, a denial of service.","category":"runtime","who_cares":["go","net/http","http2","self-hosted","golang.org/x/net"],"confidence":0.8,"analyst_note":"","how_to_check":"Run `go version` on the build host and on the server binary's Go toolchain; affected if stdlib is below 1.26.9 or in 1.27.0 to before 1.27.2. For x/net, check go.mod for golang.org/x/net below 0.60.0.","needs_analyst":false,"not_affected_if":["managed-hosting","http1-only"],"severity_if_unknown":"high"},"cost_usd":0.000399,"input_tokens":2248,"output_tokens":348,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6617':16A '-97032':13A,19A '/x/net':24A,28B 'chang':57B,156C 'client':56B,64B,123C,145C,149C 'concurr':91C 'contain':138C 'could':80C 'crash':3A,42B,71B,83C,162C 'cve':11A,17A 'denial':75B 'due':4A,84C 'encod':7A,48B,90C,100C,109C,111C,129C 'end':81C 'frame':114C,137C 'go':14A,25B,35B 'golang.org':23A,27B 'golang.org/x/net':22A,26B 'goroutin':51B,103C 'handl':134C 'happen':93C 'header':59B,113C,140C,158C 'host':34B 'hpack':6A,47B,89C,99C 'http/2':1A,39B,78C 'http2':29B 'inadvert':86C 'malici':148C 'modifi':45B,87C,97C,127C 'net/http':10A,30B,38B 'one':106C 'part':116C 'race':8A,69B 'remot':63B 'repeat':66B,151C 'request':154C 'respons':119C 'runtim':31B 'self':33B 'self-host':32B 'send':146C,152C 'sent':120C 'server':2A,40B,73B,79C,96C,164C 'servic':77B 'set':136C,139C 'size':61B,132C,142C,160C 'standard':37B 'stdlib':20A,21A 'synchron':53B,105C 'tabl':60B,131C,141C,159C 'trigger':67B 'two':50B,102C 'use':107C 'without':52B,104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6617","url":"https://pkg.go.dev/vuln/GO-2026-6617","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97032","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97032","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-97032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","severity":null,"published_at":"2026-10-08T23:17:06+00:00","modified_at":"2026-10-15T16:18:24+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}