by Kastro
Paper/Archive/CVE-2026-78663

CVE-2026-78663

Go standard library net/http — Double flow control refund on HTTP/2 server streams in net/http

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 49.7.497 × 209.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Affected

ProductAffectedFixed inSource
net/http< 1.26.91.26.9CNA
net/http/internal/http21.27.0-0 – < 1.27.21.27.2CNA
golang.org/x/net/http2< 0.60.00.60.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgo.dev/cl/847187refgo.dev/cl/847310refgo.dev/issue/81743refgroups.google.com/g/golang-announce/c/U2fTuyDJznIrefgroups.google.com/g/golang-announce/c/ZPwCyRUuGBsrefpkg.go.dev/vuln/GO-2026-6612