CVE-2026-56853

Received Received - Intake

HTTP/2 Preface ReadHeaderTimeout Bypass in Go

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: Go Project

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-56853

EUVD

EUVD-2026-58510

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.25.13 (exc)
golang	go	From 1.26.0 (inc) to 1.26.6 (exc)
golang	go	From 1.27.0 (inc) to 1.27.0-rc.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in servers configured for unencrypted HTTP/2. When a new connection is made, the server checks the first few bytes for the HTTP/2 client preface. The ReadHeaderTimeout setting, which should limit how long the server waits for this check, is not being applied during this process.

Detection Guidance

This vulnerability involves HTTP/2 preface detection without proper timeout enforcement. To detect it, monitor for unencrypted HTTP/2 connections on your network or system. Check server configurations for HTTP/2 support without TLS encryption. Use tools like Wireshark to capture and analyze traffic for HTTP/2 preface strings (PRI * HTTP/2.0 SM ). Inspect server logs for unusually long connection establishment times.

Impact Analysis

An attacker could exploit this to cause a denial of service by keeping connections open indefinitely during the preface check, overwhelming server resources.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it primarily affects server performance and availability rather than data confidentiality or integrity. The issue causes servers to hang indefinitely when reading HTTP/2 client preface without a timeout, potentially leading to denial-of-service conditions. Compliance risks would arise indirectly if such disruptions affect systems handling regulated data.

Mitigation Strategies

Disable unencrypted HTTP/2 support on your server to prevent the vulnerability from being exploited. Ensure all HTTP/2 traffic is encrypted using TLS.

Hi! I’m here to help you understand CVE-2026-56853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70