Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-78669

Excessive CPU consumption from repeated initial window changes in net/http

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.26.9affected

Go standard library net/http/internal/http2

Default version status: unaffected

  • 1.27.0-0 to < 1.27.2affected

golang.org/x/net golang.org/x/net/http2

Default version status: unaffected

  • 0 to < 0.60.0affected

References