CVE-2026-78663

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-09

Assigner: Go Project

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78663

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library net/http 0
Go	standard	library net/http/internal/http2 1.27.0-0
golang.org/x/net	golang.org/x/net/http2	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-675	The product performs the same operation on a resource two or more times, when the operation should only be applied once.

Attack-Flow Graph

Executive Summary

This vulnerability involves an HTTP/2 server incorrectly refunding connection-level flow control twice for the same data. When a client resets a stream, the server refunds data for any sent-but-unread portion. Later, when a request handler reads the buffered data, it refunds again. A malicious client can exploit this to bypass the configured connection-level flow control limit, potentially exceeding the MaxReceiveBufferPerConnection setting.

Detection Guidance

This vulnerability can be detected by checking the Go HTTP/2 server version and configuration. Use commands like 'go version' to verify the Go version and 'go list -m golang.org/x/net/http2' to check the http2 package version. Ensure the server is not using a vulnerable version of the Go standard library or golang.org/x/net/http2 package.

Impact Analysis

This vulnerability could allow an attacker to overload the server by bypassing flow control limits. This may lead to excessive memory usage, degraded performance, or denial-of-service conditions. Systems relying on HTTP/2 with Go's net/http or http2 libraries are particularly affected.

Compliance Impact

The vulnerability allows bypassing connection-level flow control limits, potentially enabling excessive data buffering. This could lead to resource exhaustion or denial-of-service conditions, which may violate compliance requirements for availability and data protection in standards like GDPR and HIPAA.

Mitigation Strategies

Update to a patched version of Go or golang.org/x/net/http2 library to address the HTTP/2 flow control bypass issue. Monitor official Go security advisories for updates.

Hi! I’m here to help you understand CVE-2026-78663. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70