Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-56853

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.25.13affected
  • 1.26.0-0 to < 1.26.6affected
  • 1.27.0-0 to < 1.27.0-rc.3affected

References