Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Go HTTP/2 server may mishandle flow control, leading to service slowdown

CVE-2026-78663 · published 3 days ago
Summary

The Go programming language’s built‑in HTTP/2 code can incorrectly refund stream flow‑control credits, which can let a malicious client consume server resources and degrade performance. This affects applications that use the standard Go net/http library for HTTP/2 communication. Updating to the latest Go release that includes the fix and reviewing any custom HTTP/2 handling will mitigate the risk.

What to do
  • Update stdlib to version 1.26.9.
  • Update stdlib to version 1.27.2.
  • Update x golang.org/x/net to version 0.60.0.
  • Update go standard library net/http to version 1.26.9 or later.
  • Update go standard library net/http/internal/http2 to version 1.27.2 or later.
  • Update golang.org/x/net golang.org/x/net/http2 to version 0.60.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– go standard library net/http < 1.26.9
– go standard library net/http/internal/http2 < 1.27.2
– golang.org/x/net golang.org/x/net/http2 < 0.60.0
Go – stdlib < 1.26.9
>= 1.27.0-0, < 1.27.2
Fix: upgrade to 1.26.9
Go x golang.org/x/net < 0.60.0
Fix: upgrade to 0.60.0
Debian:12 debian golang-1.19 All versions
Debian:13 debian golang-1.24 All versions
Debian:14 debian golang-1.25 All versions
Debian:14 debian golang-1.26 All versions
Debian:14 debian golang-1.27 All versions
Ubuntu:14.04:LTS canonical golang-1.10 All versions
Ubuntu:16.04:LTS canonical golang-1.6 All versions
Ubuntu:Pro:16.04:LTS canonical golang-golang-x-net-dev All versions
Ubuntu:Pro:16.04:LTS canonical juju-core All versions
Ubuntu:Pro:16.04:LTS canonical lxd All versions
Ubuntu:Pro:16.04:LTS canonical containerd All versions
Ubuntu:Pro:16.04:LTS canonical golang-1.13 All versions
Ubuntu:Pro:16.04:LTS canonical golang-1.18 All versions
Ubuntu:Pro:16.04:LTS canonical google-guest-agent All versions
Ubuntu:Pro:16.04:LTS canonical google-osconfig-agent All versions
Ubuntu:Pro:18.04:LTS canonical golang-1.16 All versions
Ubuntu:18.04:LTS canonical golang-1.8 All versions
Ubuntu:18.04:LTS canonical golang-1.9 All versions
Ubuntu:Pro:20.04:LTS canonical adsys All versions
Ubuntu:20.04:LTS canonical golang-1.14 All versions
Ubuntu:20.04:LTS canonical golang-1.20 All versions
Ubuntu:20.04:LTS canonical golang-1.21 All versions
Ubuntu:20.04:LTS canonical golang-1.22 All versions
Ubuntu:22.04:LTS canonical golang-1.17 All versions
Ubuntu:22.04:LTS canonical golang-1.23 All versions
Ubuntu:22.04:LTS canonical golang-1.24 All versions
Ubuntu:22.04:LTS canonical golang-golang-x-net All versions
Ubuntu:26.04:LTS canonical golang-1.25 All versions
Ubuntu:26.04:LTS canonical golang-1.26 All versions
Debian:12 debian golang-golang-x-net All versions
Original advisory text
Double flow control refund on HTTP/2 server streams in net/http
[Unknown description]
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-675Multiple Operations on Resource in Single-Operation Context
Timeline
Published9 Oct 2026
Updated12 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-78663 · NVD
CVE-2026-78663 · MITRE
DEBIAN-CVE-2026-78663 · OSV
GO-2026-6612 · OSV
UBUNTU-CVE-2026-78663 · OSV
Track software like this
Free during beta