Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure Golang 1.27.1-1 can crash from crafted HTTP/2 requests
published 27 days ago
Summary
The Go language runtime used in Azure services can stop working if an attacker sends specially crafted HTTP/2 traffic that changes the size of the header compression table while a response is being built. This race condition can make the server shut down unexpectedly, disrupting service. Update the Go package to the latest version that fixes the issue or apply the vendor's recommended patch as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | golang | >= 1.27.0, <= 1.27.1-1 |
Original advisory text
CVE-2026-97032 affecting package golang 1.27.1-1
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
References
Timeline
Published8 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
AZL-108302 · OSV
Track software like this
Free during beta