CVE-2026-78669

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-09

Assigner: Go Project

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78669

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library net/http 0
Go	standard	library net/http/internal/http2 1.27.0-0
golang.org/x/net	golang.org/x/net/http2	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-405	The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious HTTP/2 peer exploiting a flaw where opening many streams and sending numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values causes excessive CPU consumption on the client or server.

Detection Guidance

This vulnerability involves HTTP/2 SETTINGS frames causing CPU exhaustion. Monitor for unusual numbers of HTTP/2 streams or SETTINGS frames using network tools like Wireshark or tcpdump. Check Go application logs for high CPU usage during HTTP/2 traffic.

Impact Analysis

This vulnerability can lead to degraded performance or denial of service by consuming excessive CPU resources on affected systems, potentially slowing down or crashing applications using HTTP/2.

Compliance Impact

This vulnerability can lead to denial-of-service conditions due to excessive CPU consumption, which may disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it might affect the integrity and availability of protected health information systems.

Mitigation Strategies

Update Go to version 1.22.7 or later, which includes fixes for this HTTP/2 vulnerability. Monitor network traffic for unusual SETTINGS frame patterns or excessive stream openings.

Hi! I’m here to help you understand CVE-2026-78669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70