HTTP/2 Connection Flow Control Bypass in Go

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Go Project

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-78663

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library net/http 0
Go	standard	library net/http/internal/http2 1.27.0-0
golang.org/x/net	golang.org/x/net/http2	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves an HTTP/2 server incorrectly refunding connection-level flow control twice for the same data. When a client resets a stream, the server refunds data for any sent-but-unread portion. Later, when a request handler reads the buffered data, it refunds again. A malicious client can exploit this to bypass the configured connection-level flow control limit, potentially exceeding the MaxReceiveBufferPerConnection setting.

Impact Analysis

This vulnerability could allow an attacker to overload the server by bypassing flow control limits. This may lead to excessive memory usage, degraded performance, or denial-of-service conditions. Systems relying on HTTP/2 with Go's net/http or http2 libraries are particularly affected.

Mitigation Strategies

Update to a patched version of Go or golang.org/x/net/http2 library to address the HTTP/2 flow control bypass issue. Monitor official Go security advisories for updates.

Hi! I’m here to help you understand CVE-2026-78663. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70