CVE-2026-56853

Received Received - Intake

HTTP/2 Preface ReadHeaderTimeout Bypass in Go

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-56853

EUVD

EUVD-2026-58510

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs in servers configured for unencrypted HTTP/2. When a new connection is made, the server checks the first few bytes for the HTTP/2 client preface. The ReadHeaderTimeout setting, which should limit how long the server waits for this check, is not being applied during this process.

Impact Analysis

An attacker could exploit this to cause a denial of service by keeping connections open indefinitely during the preface check, overwhelming server resources.

Mitigation Strategies

Disable unencrypted HTTP/2 support on your server to prevent the vulnerability from being exploited. Ensure all HTTP/2 traffic is encrypted using TLS.

Hi! I’m here to help you understand CVE-2026-56853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70