Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
261 vulnerabilities
CVE-2026-97032 (GCVE-0-2026-97032)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:54 – Updated: 2026-10-08 22:54
VLAI
EPSS
VEX
Title
HTTP/2 server crash due to HPACK encoder race in net/http
Summary
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
Severity
No CVSS data available.
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
|
|
| Go standard library | net/http/internal/http2 |
Affected:
1.27.0-0 , < 1.27.2
(semver)
|
|
| golang.org/x/net | golang.org/x/net/http2 |
Affected:
0 , < 0.60.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "http2serverConn.processSetting"
},
{
"name": "http2serverConn.startFrameWrite"
},
{
"name": "CanonicalHeaderKey"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Cookie.String"
},
{
"name": "Cookie.Valid"
},
{
"name": "CrossOriginProtection.AddInsecureBypassPattern"
},
{
"name": "CrossOriginProtection.AddTrustedOrigin"
},
{
"name": "CrossOriginProtection.Check"
},
{
"name": "Dir.Open"
},
{
"name": "Error"
},
{
"name": "Get"
},
{
"name": "Handle"
},
{
"name": "HandleFunc"
},
{
"name": "HandlerFunc.ServeHTTP"
},
{
"name": "Head"
},
{
"name": "Header.Add"
},
{
"name": "Header.Del"
},
{
"name": "Header.Get"
},
{
"name": "Header.Set"
},
{
"name": "Header.Values"
},
{
"name": "Header.Write"
},
{
"name": "Header.WriteSubset"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "NewRequest"
},
{
"name": "NewRequestWithContext"
},
{
"name": "NotFound"
},
{
"name": "ParseCookie"
},
{
"name": "ParseSetCookie"
},
{
"name": "ParseTime"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "ProxyFromEnvironment"
},
{
"name": "ReadRequest"
},
{
"name": "ReadResponse"
},
{
"name": "Redirect"
},
{
"name": "Request.AddCookie"
},
{
"name": "Request.BasicAuth"
},
{
"name": "Request.Cookie"
},
{
"name": "Request.Cookies"
},
{
"name": "Request.CookiesNamed"
},
{
"name": "Request.FormFile"
},
{
"name": "Request.FormValue"
},
{
"name": "Request.MultipartReader"
},
{
"name": "Request.ParseForm"
},
{
"name": "Request.ParseMultipartForm"
},
{
"name": "Request.PostFormValue"
},
{
"name": "Request.Referer"
},
{
"name": "Request.SetBasicAuth"
},
{
"name": "Request.UserAgent"
},
{
"name": "Request.Write"
},
{
"name": "Request.WriteProxy"
},
{
"name": "Response.Cookies"
},
{
"name": "Response.Location"
},
{
"name": "Response.Write"
},
{
"name": "ResponseController.EnableFullDuplex"
},
{
"name": "ResponseController.Flush"
},
{
"name": "ResponseController.Hijack"
},
{
"name": "ResponseController.SetReadDeadline"
},
{
"name": "ResponseController.SetWriteDeadline"
},
{
"name": "Serve"
},
{
"name": "ServeContent"
},
{
"name": "ServeFile"
},
{
"name": "ServeFileFS"
},
{
"name": "ServeMux.Handle"
},
{
"name": "ServeMux.HandleFunc"
},
{
"name": "ServeMux.ServeHTTP"
},
{
"name": "ServeTLS"
},
{
"name": "Server.Close"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
},
{
"name": "Server.SetKeepAlivesEnabled"
},
{
"name": "Server.Shutdown"
},
{
"name": "SetCookie"
},
{
"name": "Transport.CancelRequest"
},
{
"name": "Transport.Clone"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "body.Close"
},
{
"name": "body.Read"
},
{
"name": "bodyEOFSignal.Close"
},
{
"name": "bodyEOFSignal.Read"
},
{
"name": "bodyLocked.Read"
},
{
"name": "bufioFlushWriter.Write"
},
{
"name": "cancelTimerBody.Close"
},
{
"name": "cancelTimerBody.Read"
},
{
"name": "checkConnErrorWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "connReader.Read"
},
{
"name": "connectMethodKey.String"
},
{
"name": "expectContinueReader.Close"
},
{
"name": "expectContinueReader.Read"
},
{
"name": "extraHeader.Write"
},
{
"name": "fileHandler.ServeHTTP"
},
{
"name": "fileTransport.RoundTrip"
},
{
"name": "globalOptionsHandler.ServeHTTP"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Close"
},
{
"name": "http2ClientConn.Ping"
},
{
"name": "http2ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Shutdown"
},
{
"name": "http2ConnectionError.Error"
},
{
"name": "http2ErrCode.String"
},
{
"name": "http2FrameHeader.String"
},
{
"name": "http2FrameType.String"
},
{
"name": "http2FrameWriteRequest.String"
},
{
"name": "http2Framer.ReadFrame"
},
{
"name": "http2Framer.ReadFrameForHeader"
},
{
"name": "http2Framer.ReadFrameHeader"
},
{
"name": "http2Framer.WriteContinuation"
},
{
"name": "http2Framer.WriteData"
},
{
"name": "http2Framer.WriteDataPadded"
},
{
"name": "http2Framer.WriteGoAway"
},
{
"name": "http2Framer.WriteHeaders"
},
{
"name": "http2Framer.WritePing"
},
{
"name": "http2Framer.WritePriority"
},
{
"name": "http2Framer.WritePushPromise"
},
{
"name": "http2Framer.WriteRSTStream"
},
{
"name": "http2Framer.WriteRawFrame"
},
{
"name": "http2Framer.WriteSettings"
},
{
"name": "http2Framer.WriteSettingsAck"
},
{
"name": "http2Framer.WriteWindowUpdate"
},
{
"name": "http2GoAwayError.Error"
},
{
"name": "http2Server.ServeConn"
},
{
"name": "http2Setting.String"
},
{
"name": "http2SettingID.String"
},
{
"name": "http2SettingsFrame.ForeachSetting"
},
{
"name": "http2StreamError.Error"
},
{
"name": "http2Transport.CloseIdleConnections"
},
{
"name": "http2Transport.NewClientConn"
},
{
"name": "http2Transport.RoundTrip"
},
{
"name": "http2Transport.RoundTripOpt"
},
{
"name": "http2bufferedWriter.Flush"
},
{
"name": "http2bufferedWriter.Write"
},
{
"name": "http2bufferedWriterTimeoutWriter.Write"
},
{
"name": "http2chunkWriter.Write"
},
{
"name": "http2clientConnPool.GetClientConn"
},
{
"name": "http2connError.Error"
},
{
"name": "http2dataBuffer.Read"
},
{
"name": "http2duplicatePseudoHeaderError.Error"
},
{
"name": "http2gzipReader.Close"
},
{
"name": "http2gzipReader.Read"
},
{
"name": "http2headerFieldNameError.Error"
},
{
"name": "http2headerFieldValueError.Error"
},
{
"name": "http2netHTTPClientConn.Close"
},
{
"name": "http2netHTTPClientConn.RoundTrip"
},
{
"name": "http2noDialClientConnPool.GetClientConn"
},
{
"name": "http2noDialH2RoundTripper.NewClientConn"
},
{
"name": "http2noDialH2RoundTripper.RoundTrip"
},
{
"name": "http2pipe.Read"
},
{
"name": "http2priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "http2priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "http2priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "http2pseudoHeaderError.Error"
},
{
"name": "http2requestBody.Close"
},
{
"name": "http2requestBody.Read"
},
{
"name": "http2responseWriter.Flush"
},
{
"name": "http2responseWriter.FlushError"
},
{
"name": "http2responseWriter.Push"
},
{
"name": "http2responseWriter.SetReadDeadline"
},
{
"name": "http2responseWriter.SetWriteDeadline"
},
{
"name": "http2responseWriter.Write"
},
{
"name": "http2responseWriter.WriteHeader"
},
{
"name": "http2responseWriter.WriteString"
},
{
"name": "http2roundRobinWriteScheduler.OpenStream"
},
{
"name": "http2serverConn.CloseConn"
},
{
"name": "http2serverConn.Flush"
},
{
"name": "http2stickyErrWriter.Write"
},
{
"name": "http2transportResponseBody.Close"
},
{
"name": "http2transportResponseBody.Read"
},
{
"name": "http2unencryptedTransport.RoundTrip"
},
{
"name": "http2writeData.String"
},
{
"name": "initALPNRequest.ServeHTTP"
},
{
"name": "loggingConn.Close"
},
{
"name": "loggingConn.Read"
},
{
"name": "loggingConn.Write"
},
{
"name": "maxBytesReader.Close"
},
{
"name": "maxBytesReader.Read"
},
{
"name": "onceCloseListener.Close"
},
{
"name": "persistConn.Read"
},
{
"name": "persistConnWriter.ReadFrom"
},
{
"name": "persistConnWriter.Write"
},
{
"name": "populateResponse.Write"
},
{
"name": "populateResponse.WriteHeader"
},
{
"name": "readTrackingBody.Close"
},
{
"name": "readTrackingBody.Read"
},
{
"name": "readWriteCloserBody.CloseWrite"
},
{
"name": "readWriteCloserBody.Read"
},
{
"name": "redirectHandler.ServeHTTP"
},
{
"name": "response.Flush"
},
{
"name": "response.FlushError"
},
{
"name": "response.Hijack"
},
{
"name": "response.ReadFrom"
},
{
"name": "response.Write"
},
{
"name": "response.WriteHeader"
},
{
"name": "response.WriteString"
},
{
"name": "serverHandler.ServeHTTP"
},
{
"name": "socksDialer.DialWithConn"
},
{
"name": "socksUsernamePassword.Authenticate"
},
{
"name": "stringWriter.WriteString"
},
{
"name": "timeoutHandler.ServeHTTP"
},
{
"name": "timeoutWriter.Write"
},
{
"name": "timeoutWriter.WriteHeader"
},
{
"name": "transportReadFromServerError.Error"
},
{
"name": "unencryptedHTTP2Request.ServeHTTP"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http/internal/http2",
"product": "net/http/internal/http2",
"programRoutines": [
{
"name": "serverConn.processSetting"
},
{
"name": "serverConn.startFrameWrite"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "NetHTTPClientConn.Close"
},
{
"name": "NetHTTPClientConn.Ping"
},
{
"name": "NetHTTPClientConn.RoundTrip"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.GracefulShutdown"
},
{
"name": "Server.ServeConn"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "Transport.AddConn"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "requestBody.Close"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "serve400Handler.ServeHTTP"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/http2",
"product": "golang.org/x/net/http2",
"programRoutines": [
{
"name": "serverConn.processSetting"
},
{
"name": "serverConn.startFrameWrite"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "ConfigureServer"
},
{
"name": "ConfigureTransport"
},
{
"name": "ConfigureTransports"
},
{
"name": "ConnectionError.Error"
},
{
"name": "ErrCode.String"
},
{
"name": "FrameHeader.String"
},
{
"name": "FrameType.String"
},
{
"name": "FrameWriteRequest.String"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "GoAwayError.Error"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.ServeConn"
},
{
"name": "Setting.String"
},
{
"name": "SettingID.String"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "StreamError.Error"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "connError.Error"
},
{
"name": "dataBuffer.Read"
},
{
"name": "duplicatePseudoHeaderError.Error"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "headerFieldNameError.Error"
},
{
"name": "headerFieldValueError.Error"
},
{
"name": "netHTTPClientConn.Close"
},
{
"name": "netHTTPClientConn.RoundTrip"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "noDialH2RoundTripper.NewClientConn"
},
{
"name": "noDialH2RoundTripper.RoundTrip"
},
{
"name": "pipe.Read"
},
{
"name": "priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "pseudoHeaderError.Error"
},
{
"name": "requestBody.Close"
},
{
"name": "requestBody.Read"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.SetReadDeadline"
},
{
"name": "responseWriter.SetWriteDeadline"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "roundRobinWriteScheduler.OpenStream"
},
{
"name": "serverConn.CloseConn"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
},
{
"name": "unencryptedTransport.RoundTrip"
},
{
"name": "writeData.String"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.60.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"value": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder\u0027s table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:54:00.230Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847188"
},
{
"url": "https://go.dev/cl/847313"
},
{
"url": "https://go.dev/issue/81867"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6617"
}
],
"title": "HTTP/2 server crash due to HPACK encoder race in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97032",
"datePublished": "2026-10-08T22:54:00.230Z",
"dateReserved": "2026-09-23T23:03:58.333Z",
"dateUpdated": "2026-10-08T22:54:00.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94439 (GCVE-0-2026-94439)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:52
VLAI
EPSS
VEX
Title
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
Summary
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:45 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-94439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:45:53.919403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:52:15.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "chunkWriter.writeHeader"
},
{
"name": "CanonicalHeaderKey"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Cookie.String"
},
{
"name": "Cookie.Valid"
},
{
"name": "CrossOriginProtection.AddInsecureBypassPattern"
},
{
"name": "CrossOriginProtection.AddTrustedOrigin"
},
{
"name": "CrossOriginProtection.Check"
},
{
"name": "Dir.Open"
},
{
"name": "Error"
},
{
"name": "Get"
},
{
"name": "Handle"
},
{
"name": "HandleFunc"
},
{
"name": "HandlerFunc.ServeHTTP"
},
{
"name": "Head"
},
{
"name": "Header.Add"
},
{
"name": "Header.Del"
},
{
"name": "Header.Get"
},
{
"name": "Header.Set"
},
{
"name": "Header.Values"
},
{
"name": "Header.Write"
},
{
"name": "Header.WriteSubset"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "NewRequest"
},
{
"name": "NewRequestWithContext"
},
{
"name": "NotFound"
},
{
"name": "ParseCookie"
},
{
"name": "ParseSetCookie"
},
{
"name": "ParseTime"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "ProxyFromEnvironment"
},
{
"name": "ReadRequest"
},
{
"name": "ReadResponse"
},
{
"name": "Redirect"
},
{
"name": "Request.AddCookie"
},
{
"name": "Request.BasicAuth"
},
{
"name": "Request.Cookie"
},
{
"name": "Request.Cookies"
},
{
"name": "Request.CookiesNamed"
},
{
"name": "Request.FormFile"
},
{
"name": "Request.FormValue"
},
{
"name": "Request.MultipartReader"
},
{
"name": "Request.ParseForm"
},
{
"name": "Request.ParseMultipartForm"
},
{
"name": "Request.PostFormValue"
},
{
"name": "Request.Referer"
},
{
"name": "Request.SetBasicAuth"
},
{
"name": "Request.UserAgent"
},
{
"name": "Request.Write"
},
{
"name": "Request.WriteProxy"
},
{
"name": "Response.Cookies"
},
{
"name": "Response.Location"
},
{
"name": "Response.Write"
},
{
"name": "ResponseController.EnableFullDuplex"
},
{
"name": "ResponseController.Flush"
},
{
"name": "ResponseController.Hijack"
},
{
"name": "ResponseController.SetReadDeadline"
},
{
"name": "ResponseController.SetWriteDeadline"
},
{
"name": "Serve"
},
{
"name": "ServeContent"
},
{
"name": "ServeFile"
},
{
"name": "ServeFileFS"
},
{
"name": "ServeMux.Handle"
},
{
"name": "ServeMux.HandleFunc"
},
{
"name": "ServeMux.ServeHTTP"
},
{
"name": "ServeTLS"
},
{
"name": "Server.Close"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
},
{
"name": "Server.SetKeepAlivesEnabled"
},
{
"name": "Server.Shutdown"
},
{
"name": "SetCookie"
},
{
"name": "Transport.CancelRequest"
},
{
"name": "Transport.Clone"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "body.Close"
},
{
"name": "body.Read"
},
{
"name": "bodyEOFSignal.Close"
},
{
"name": "bodyEOFSignal.Read"
},
{
"name": "bodyLocked.Read"
},
{
"name": "bufioFlushWriter.Write"
},
{
"name": "cancelTimerBody.Close"
},
{
"name": "cancelTimerBody.Read"
},
{
"name": "checkConnErrorWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "connReader.Read"
},
{
"name": "connectMethodKey.String"
},
{
"name": "expectContinueReader.Close"
},
{
"name": "expectContinueReader.Read"
},
{
"name": "extraHeader.Write"
},
{
"name": "fileHandler.ServeHTTP"
},
{
"name": "fileTransport.RoundTrip"
},
{
"name": "globalOptionsHandler.ServeHTTP"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.RoundTrip"
},
{
"name": "http2Handler.ServeHTTP"
},
{
"name": "http2ResponseWriter.Flush"
},
{
"name": "http2ResponseWriter.FlushError"
},
{
"name": "http2ResponseWriter.Push"
},
{
"name": "http2RoundTripper.RoundTrip"
},
{
"name": "http3ServerHandler.ServeHTTP"
},
{
"name": "initALPNRequest.ServeHTTP"
},
{
"name": "loggingConn.Close"
},
{
"name": "loggingConn.Read"
},
{
"name": "loggingConn.Write"
},
{
"name": "maxBytesReader.Close"
},
{
"name": "maxBytesReader.Read"
},
{
"name": "onceCloseListener.Close"
},
{
"name": "persistConn.Read"
},
{
"name": "persistConnWriter.ReadFrom"
},
{
"name": "persistConnWriter.Write"
},
{
"name": "populateResponse.Write"
},
{
"name": "populateResponse.WriteHeader"
},
{
"name": "readTrackingBody.Close"
},
{
"name": "readTrackingBody.Read"
},
{
"name": "readWriteCloserBody.CloseWrite"
},
{
"name": "readWriteCloserBody.Read"
},
{
"name": "redirectHandler.ServeHTTP"
},
{
"name": "response.Flush"
},
{
"name": "response.FlushError"
},
{
"name": "response.Hijack"
},
{
"name": "response.ReadFrom"
},
{
"name": "response.Write"
},
{
"name": "response.WriteHeader"
},
{
"name": "response.WriteString"
},
{
"name": "serverHandler.ServeHTTP"
},
{
"name": "socksDialer.DialWithConn"
},
{
"name": "socksUsernamePassword.Authenticate"
},
{
"name": "stringWriter.WriteString"
},
{
"name": "timeoutHandler.ServeHTTP"
},
{
"name": "timeoutWriter.Write"
},
{
"name": "timeoutWriter.WriteHeader"
},
{
"name": "transportReadFromServerError.Error"
},
{
"name": "unencryptedHTTP2Request.ServeHTTP"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Ciolek (https://ciolek.dev)"
}
],
"descriptions": [
{
"lang": "en",
"value": "When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:59.976Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847311"
},
{
"url": "https://go.dev/issue/81744"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6613"
}
],
"title": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-94439",
"datePublished": "2026-10-08T22:53:59.976Z",
"dateReserved": "2026-09-21T16:43:04.757Z",
"dateUpdated": "2026-10-09T16:52:15.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78663 (GCVE-0-2026-78663)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:42
VLAI
EPSS
VEX
Title
Double flow control refund on HTTP/2 server streams in net/http
Summary
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:40 UTC
CWE
- CWE-675 - Multiple Operations on Resource in Single-Operation Context
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
|
|
| Go standard library | net/http/internal/http2 |
Affected:
1.27.0-0 , < 1.27.2
(semver)
|
|
| golang.org/x/net | golang.org/x/net/http2 |
Affected:
0 , < 0.60.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:40:08.220862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-675",
"description": "CWE-675 Multiple Operations on Resource in Single-Operation Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:42:50.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "http2requestBody.Close"
},
{
"name": "http2requestBody.Read"
},
{
"name": "http2serverConn.closeStream"
},
{
"name": "http2serverConn.handlerDone"
},
{
"name": "http2serverConn.newWriterAndRequest"
},
{
"name": "http2serverConn.newWriterAndRequestNoBody"
},
{
"name": "http2serverConn.noteBodyRead"
},
{
"name": "http2serverConn.processHeaders"
},
{
"name": "http2serverConn.runHandler"
},
{
"name": "http2serverConn.scheduleHandler"
},
{
"name": "CanonicalHeaderKey"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Cookie.String"
},
{
"name": "Cookie.Valid"
},
{
"name": "CrossOriginProtection.AddInsecureBypassPattern"
},
{
"name": "CrossOriginProtection.AddTrustedOrigin"
},
{
"name": "CrossOriginProtection.Check"
},
{
"name": "Dir.Open"
},
{
"name": "Error"
},
{
"name": "Get"
},
{
"name": "Handle"
},
{
"name": "HandleFunc"
},
{
"name": "HandlerFunc.ServeHTTP"
},
{
"name": "Head"
},
{
"name": "Header.Add"
},
{
"name": "Header.Del"
},
{
"name": "Header.Get"
},
{
"name": "Header.Set"
},
{
"name": "Header.Values"
},
{
"name": "Header.Write"
},
{
"name": "Header.WriteSubset"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "NewRequest"
},
{
"name": "NewRequestWithContext"
},
{
"name": "NotFound"
},
{
"name": "ParseCookie"
},
{
"name": "ParseSetCookie"
},
{
"name": "ParseTime"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "ProxyFromEnvironment"
},
{
"name": "ReadRequest"
},
{
"name": "ReadResponse"
},
{
"name": "Redirect"
},
{
"name": "Request.AddCookie"
},
{
"name": "Request.BasicAuth"
},
{
"name": "Request.Cookie"
},
{
"name": "Request.Cookies"
},
{
"name": "Request.CookiesNamed"
},
{
"name": "Request.FormFile"
},
{
"name": "Request.FormValue"
},
{
"name": "Request.MultipartReader"
},
{
"name": "Request.ParseForm"
},
{
"name": "Request.ParseMultipartForm"
},
{
"name": "Request.PostFormValue"
},
{
"name": "Request.Referer"
},
{
"name": "Request.SetBasicAuth"
},
{
"name": "Request.UserAgent"
},
{
"name": "Request.Write"
},
{
"name": "Request.WriteProxy"
},
{
"name": "Response.Cookies"
},
{
"name": "Response.Location"
},
{
"name": "Response.Write"
},
{
"name": "ResponseController.EnableFullDuplex"
},
{
"name": "ResponseController.Flush"
},
{
"name": "ResponseController.Hijack"
},
{
"name": "ResponseController.SetReadDeadline"
},
{
"name": "ResponseController.SetWriteDeadline"
},
{
"name": "Serve"
},
{
"name": "ServeContent"
},
{
"name": "ServeFile"
},
{
"name": "ServeFileFS"
},
{
"name": "ServeMux.Handle"
},
{
"name": "ServeMux.HandleFunc"
},
{
"name": "ServeMux.ServeHTTP"
},
{
"name": "ServeTLS"
},
{
"name": "Server.Close"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
},
{
"name": "Server.SetKeepAlivesEnabled"
},
{
"name": "Server.Shutdown"
},
{
"name": "SetCookie"
},
{
"name": "Transport.CancelRequest"
},
{
"name": "Transport.Clone"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "body.Close"
},
{
"name": "body.Read"
},
{
"name": "bodyEOFSignal.Close"
},
{
"name": "bodyEOFSignal.Read"
},
{
"name": "bodyLocked.Read"
},
{
"name": "bufioFlushWriter.Write"
},
{
"name": "cancelTimerBody.Close"
},
{
"name": "cancelTimerBody.Read"
},
{
"name": "checkConnErrorWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "connReader.Read"
},
{
"name": "connectMethodKey.String"
},
{
"name": "expectContinueReader.Close"
},
{
"name": "expectContinueReader.Read"
},
{
"name": "extraHeader.Write"
},
{
"name": "fileHandler.ServeHTTP"
},
{
"name": "fileTransport.RoundTrip"
},
{
"name": "globalOptionsHandler.ServeHTTP"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Close"
},
{
"name": "http2ClientConn.Ping"
},
{
"name": "http2ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Shutdown"
},
{
"name": "http2ConnectionError.Error"
},
{
"name": "http2ErrCode.String"
},
{
"name": "http2FrameHeader.String"
},
{
"name": "http2FrameType.String"
},
{
"name": "http2FrameWriteRequest.String"
},
{
"name": "http2Framer.ReadFrame"
},
{
"name": "http2Framer.ReadFrameForHeader"
},
{
"name": "http2Framer.ReadFrameHeader"
},
{
"name": "http2Framer.WriteContinuation"
},
{
"name": "http2Framer.WriteData"
},
{
"name": "http2Framer.WriteDataPadded"
},
{
"name": "http2Framer.WriteGoAway"
},
{
"name": "http2Framer.WriteHeaders"
},
{
"name": "http2Framer.WritePing"
},
{
"name": "http2Framer.WritePriority"
},
{
"name": "http2Framer.WritePushPromise"
},
{
"name": "http2Framer.WriteRSTStream"
},
{
"name": "http2Framer.WriteRawFrame"
},
{
"name": "http2Framer.WriteSettings"
},
{
"name": "http2Framer.WriteSettingsAck"
},
{
"name": "http2Framer.WriteWindowUpdate"
},
{
"name": "http2GoAwayError.Error"
},
{
"name": "http2Server.ServeConn"
},
{
"name": "http2Setting.String"
},
{
"name": "http2SettingID.String"
},
{
"name": "http2SettingsFrame.ForeachSetting"
},
{
"name": "http2StreamError.Error"
},
{
"name": "http2Transport.CloseIdleConnections"
},
{
"name": "http2Transport.NewClientConn"
},
{
"name": "http2Transport.RoundTrip"
},
{
"name": "http2Transport.RoundTripOpt"
},
{
"name": "http2bufferedWriter.Flush"
},
{
"name": "http2bufferedWriter.Write"
},
{
"name": "http2bufferedWriterTimeoutWriter.Write"
},
{
"name": "http2chunkWriter.Write"
},
{
"name": "http2clientConnPool.GetClientConn"
},
{
"name": "http2connError.Error"
},
{
"name": "http2dataBuffer.Read"
},
{
"name": "http2duplicatePseudoHeaderError.Error"
},
{
"name": "http2gzipReader.Close"
},
{
"name": "http2gzipReader.Read"
},
{
"name": "http2headerFieldNameError.Error"
},
{
"name": "http2headerFieldValueError.Error"
},
{
"name": "http2netHTTPClientConn.Close"
},
{
"name": "http2netHTTPClientConn.RoundTrip"
},
{
"name": "http2noDialClientConnPool.GetClientConn"
},
{
"name": "http2noDialH2RoundTripper.NewClientConn"
},
{
"name": "http2noDialH2RoundTripper.RoundTrip"
},
{
"name": "http2pipe.Read"
},
{
"name": "http2priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "http2priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "http2priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "http2pseudoHeaderError.Error"
},
{
"name": "http2responseWriter.Flush"
},
{
"name": "http2responseWriter.FlushError"
},
{
"name": "http2responseWriter.Push"
},
{
"name": "http2responseWriter.SetReadDeadline"
},
{
"name": "http2responseWriter.SetWriteDeadline"
},
{
"name": "http2responseWriter.Write"
},
{
"name": "http2responseWriter.WriteHeader"
},
{
"name": "http2responseWriter.WriteString"
},
{
"name": "http2roundRobinWriteScheduler.OpenStream"
},
{
"name": "http2serverConn.CloseConn"
},
{
"name": "http2serverConn.Flush"
},
{
"name": "http2stickyErrWriter.Write"
},
{
"name": "http2transportResponseBody.Close"
},
{
"name": "http2transportResponseBody.Read"
},
{
"name": "http2unencryptedTransport.RoundTrip"
},
{
"name": "http2writeData.String"
},
{
"name": "initALPNRequest.ServeHTTP"
},
{
"name": "loggingConn.Close"
},
{
"name": "loggingConn.Read"
},
{
"name": "loggingConn.Write"
},
{
"name": "maxBytesReader.Close"
},
{
"name": "maxBytesReader.Read"
},
{
"name": "onceCloseListener.Close"
},
{
"name": "persistConn.Read"
},
{
"name": "persistConnWriter.ReadFrom"
},
{
"name": "persistConnWriter.Write"
},
{
"name": "populateResponse.Write"
},
{
"name": "populateResponse.WriteHeader"
},
{
"name": "readTrackingBody.Close"
},
{
"name": "readTrackingBody.Read"
},
{
"name": "readWriteCloserBody.CloseWrite"
},
{
"name": "readWriteCloserBody.Read"
},
{
"name": "redirectHandler.ServeHTTP"
},
{
"name": "response.Flush"
},
{
"name": "response.FlushError"
},
{
"name": "response.Hijack"
},
{
"name": "response.ReadFrom"
},
{
"name": "response.Write"
},
{
"name": "response.WriteHeader"
},
{
"name": "response.WriteString"
},
{
"name": "serverHandler.ServeHTTP"
},
{
"name": "socksDialer.DialWithConn"
},
{
"name": "socksUsernamePassword.Authenticate"
},
{
"name": "stringWriter.WriteString"
},
{
"name": "timeoutHandler.ServeHTTP"
},
{
"name": "timeoutWriter.Write"
},
{
"name": "timeoutWriter.WriteHeader"
},
{
"name": "transportReadFromServerError.Error"
},
{
"name": "unencryptedHTTP2Request.ServeHTTP"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http/internal/http2",
"product": "net/http/internal/http2",
"programRoutines": [
{
"name": "requestBody.Close"
},
{
"name": "requestBody.Read"
},
{
"name": "serverConn.closeStream"
},
{
"name": "serverConn.handlerDone"
},
{
"name": "serverConn.newWriterAndRequest"
},
{
"name": "serverConn.newWriterAndRequestNoBody"
},
{
"name": "serverConn.noteBodyRead"
},
{
"name": "serverConn.processHeaders"
},
{
"name": "serverConn.runHandler"
},
{
"name": "serverConn.scheduleHandler"
},
{
"name": "Server.ServeConn"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/http2",
"product": "golang.org/x/net/http2",
"programRoutines": [
{
"name": "requestBody.Close"
},
{
"name": "requestBody.Read"
},
{
"name": "serverConn.closeStream"
},
{
"name": "serverConn.handlerDone"
},
{
"name": "serverConn.newWriterAndRequest"
},
{
"name": "serverConn.newWriterAndRequestNoBody"
},
{
"name": "serverConn.noteBodyRead"
},
{
"name": "serverConn.processHeaders"
},
{
"name": "serverConn.runHandler"
},
{
"name": "serverConn.scheduleHandler"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "ConfigureServer"
},
{
"name": "ConfigureTransport"
},
{
"name": "ConfigureTransports"
},
{
"name": "ConnectionError.Error"
},
{
"name": "ErrCode.String"
},
{
"name": "FrameHeader.String"
},
{
"name": "FrameType.String"
},
{
"name": "FrameWriteRequest.String"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "GoAwayError.Error"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.ServeConn"
},
{
"name": "Setting.String"
},
{
"name": "SettingID.String"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "StreamError.Error"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "connError.Error"
},
{
"name": "dataBuffer.Read"
},
{
"name": "duplicatePseudoHeaderError.Error"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "headerFieldNameError.Error"
},
{
"name": "headerFieldValueError.Error"
},
{
"name": "netHTTPClientConn.Close"
},
{
"name": "netHTTPClientConn.RoundTrip"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "noDialH2RoundTripper.NewClientConn"
},
{
"name": "noDialH2RoundTripper.RoundTrip"
},
{
"name": "pipe.Read"
},
{
"name": "priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "pseudoHeaderError.Error"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.SetReadDeadline"
},
{
"name": "responseWriter.SetWriteDeadline"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "roundRobinWriteScheduler.OpenStream"
},
{
"name": "serverConn.CloseConn"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
},
{
"name": "unencryptedTransport.RoundTrip"
},
{
"name": "writeData.String"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.60.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-675: Multiple Operations on Resource in Single-Operation Context",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:59.772Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847187"
},
{
"url": "https://go.dev/cl/847310"
},
{
"url": "https://go.dev/issue/81743"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6612"
}
],
"title": "Double flow control refund on HTTP/2 server streams in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-78663",
"datePublished": "2026-10-08T22:53:59.772Z",
"dateReserved": "2026-08-24T23:36:15.738Z",
"dateUpdated": "2026-10-09T16:42:50.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78669 (GCVE-0-2026-78669)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:32
VLAI
EPSS
VEX
Title
Excessive CPU consumption from repeated initial window changes in net/http
Summary
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:32 UTC
CWE
- CWE-405 - Asymmetric Resource Consumption (Amplification)
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
|
|
| Go standard library | net/http/internal/http2 |
Affected:
1.27.0-0 , < 1.27.2
(semver)
|
|
| golang.org/x/net | golang.org/x/net/http2 |
Affected:
0 , < 0.60.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:32:53.872432Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:32:57.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "http2outflow.add"
},
{
"name": "http2outflow.available"
},
{
"name": "http2outflow.setConnFlow"
},
{
"name": "http2outflow.take"
},
{
"name": "http2Server.serveConn"
},
{
"name": "http2serverConn.newStream"
},
{
"name": "http2serverConn.processSettingInitialWindowSize"
},
{
"name": "http2serverConn.processWindowUpdate"
},
{
"name": "http2serverConn.scheduleFrameWrite"
},
{
"name": "http2ClientConn.addStreamLocked"
},
{
"name": "http2Transport.newClientConn"
},
{
"name": "http2clientConnReadLoop.processSettingsNoWrite"
},
{
"name": "http2clientConnReadLoop.processWindowUpdate"
},
{
"name": "http2clientConnReadLoop.streamByID"
},
{
"name": "http2clientStream.awaitFlowControl"
},
{
"name": "http2clientStream.cleanupWriteRequest"
},
{
"name": "http2FrameWriteRequest.Consume"
},
{
"name": "CanonicalHeaderKey"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Cookie.String"
},
{
"name": "Cookie.Valid"
},
{
"name": "CrossOriginProtection.AddInsecureBypassPattern"
},
{
"name": "CrossOriginProtection.AddTrustedOrigin"
},
{
"name": "CrossOriginProtection.Check"
},
{
"name": "Dir.Open"
},
{
"name": "Error"
},
{
"name": "Get"
},
{
"name": "Handle"
},
{
"name": "HandleFunc"
},
{
"name": "HandlerFunc.ServeHTTP"
},
{
"name": "Head"
},
{
"name": "Header.Add"
},
{
"name": "Header.Del"
},
{
"name": "Header.Get"
},
{
"name": "Header.Set"
},
{
"name": "Header.Values"
},
{
"name": "Header.Write"
},
{
"name": "Header.WriteSubset"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "NewRequest"
},
{
"name": "NewRequestWithContext"
},
{
"name": "NotFound"
},
{
"name": "ParseCookie"
},
{
"name": "ParseSetCookie"
},
{
"name": "ParseTime"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "ProxyFromEnvironment"
},
{
"name": "ReadRequest"
},
{
"name": "ReadResponse"
},
{
"name": "Redirect"
},
{
"name": "Request.AddCookie"
},
{
"name": "Request.BasicAuth"
},
{
"name": "Request.Cookie"
},
{
"name": "Request.Cookies"
},
{
"name": "Request.CookiesNamed"
},
{
"name": "Request.FormFile"
},
{
"name": "Request.FormValue"
},
{
"name": "Request.MultipartReader"
},
{
"name": "Request.ParseForm"
},
{
"name": "Request.ParseMultipartForm"
},
{
"name": "Request.PostFormValue"
},
{
"name": "Request.Referer"
},
{
"name": "Request.SetBasicAuth"
},
{
"name": "Request.UserAgent"
},
{
"name": "Request.Write"
},
{
"name": "Request.WriteProxy"
},
{
"name": "Response.Cookies"
},
{
"name": "Response.Location"
},
{
"name": "Response.Write"
},
{
"name": "ResponseController.EnableFullDuplex"
},
{
"name": "ResponseController.Flush"
},
{
"name": "ResponseController.Hijack"
},
{
"name": "ResponseController.SetReadDeadline"
},
{
"name": "ResponseController.SetWriteDeadline"
},
{
"name": "Serve"
},
{
"name": "ServeContent"
},
{
"name": "ServeFile"
},
{
"name": "ServeFileFS"
},
{
"name": "ServeMux.Handle"
},
{
"name": "ServeMux.HandleFunc"
},
{
"name": "ServeMux.ServeHTTP"
},
{
"name": "ServeTLS"
},
{
"name": "Server.Close"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
},
{
"name": "Server.SetKeepAlivesEnabled"
},
{
"name": "Server.Shutdown"
},
{
"name": "SetCookie"
},
{
"name": "Transport.CancelRequest"
},
{
"name": "Transport.Clone"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "body.Close"
},
{
"name": "body.Read"
},
{
"name": "bodyEOFSignal.Close"
},
{
"name": "bodyEOFSignal.Read"
},
{
"name": "bodyLocked.Read"
},
{
"name": "bufioFlushWriter.Write"
},
{
"name": "cancelTimerBody.Close"
},
{
"name": "cancelTimerBody.Read"
},
{
"name": "checkConnErrorWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "connReader.Read"
},
{
"name": "connectMethodKey.String"
},
{
"name": "expectContinueReader.Close"
},
{
"name": "expectContinueReader.Read"
},
{
"name": "extraHeader.Write"
},
{
"name": "fileHandler.ServeHTTP"
},
{
"name": "fileTransport.RoundTrip"
},
{
"name": "globalOptionsHandler.ServeHTTP"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Close"
},
{
"name": "http2ClientConn.Ping"
},
{
"name": "http2ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Shutdown"
},
{
"name": "http2ConnectionError.Error"
},
{
"name": "http2ErrCode.String"
},
{
"name": "http2FrameHeader.String"
},
{
"name": "http2FrameType.String"
},
{
"name": "http2FrameWriteRequest.String"
},
{
"name": "http2Framer.ReadFrame"
},
{
"name": "http2Framer.ReadFrameForHeader"
},
{
"name": "http2Framer.ReadFrameHeader"
},
{
"name": "http2Framer.WriteContinuation"
},
{
"name": "http2Framer.WriteData"
},
{
"name": "http2Framer.WriteDataPadded"
},
{
"name": "http2Framer.WriteGoAway"
},
{
"name": "http2Framer.WriteHeaders"
},
{
"name": "http2Framer.WritePing"
},
{
"name": "http2Framer.WritePriority"
},
{
"name": "http2Framer.WritePushPromise"
},
{
"name": "http2Framer.WriteRSTStream"
},
{
"name": "http2Framer.WriteRawFrame"
},
{
"name": "http2Framer.WriteSettings"
},
{
"name": "http2Framer.WriteSettingsAck"
},
{
"name": "http2Framer.WriteWindowUpdate"
},
{
"name": "http2GoAwayError.Error"
},
{
"name": "http2Server.ServeConn"
},
{
"name": "http2Setting.String"
},
{
"name": "http2SettingID.String"
},
{
"name": "http2SettingsFrame.ForeachSetting"
},
{
"name": "http2StreamError.Error"
},
{
"name": "http2Transport.CloseIdleConnections"
},
{
"name": "http2Transport.NewClientConn"
},
{
"name": "http2Transport.RoundTrip"
},
{
"name": "http2Transport.RoundTripOpt"
},
{
"name": "http2bufferedWriter.Flush"
},
{
"name": "http2bufferedWriter.Write"
},
{
"name": "http2bufferedWriterTimeoutWriter.Write"
},
{
"name": "http2chunkWriter.Write"
},
{
"name": "http2clientConnPool.GetClientConn"
},
{
"name": "http2connError.Error"
},
{
"name": "http2dataBuffer.Read"
},
{
"name": "http2duplicatePseudoHeaderError.Error"
},
{
"name": "http2gzipReader.Close"
},
{
"name": "http2gzipReader.Read"
},
{
"name": "http2headerFieldNameError.Error"
},
{
"name": "http2headerFieldValueError.Error"
},
{
"name": "http2netHTTPClientConn.Close"
},
{
"name": "http2netHTTPClientConn.RoundTrip"
},
{
"name": "http2noDialClientConnPool.GetClientConn"
},
{
"name": "http2noDialH2RoundTripper.NewClientConn"
},
{
"name": "http2noDialH2RoundTripper.RoundTrip"
},
{
"name": "http2pipe.Read"
},
{
"name": "http2priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "http2priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "http2priorityWriteSchedulerRFC7540.Pop"
},
{
"name": "http2priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "http2priorityWriteSchedulerRFC9218.Pop"
},
{
"name": "http2pseudoHeaderError.Error"
},
{
"name": "http2randomWriteScheduler.Pop"
},
{
"name": "http2requestBody.Close"
},
{
"name": "http2requestBody.Read"
},
{
"name": "http2responseWriter.Flush"
},
{
"name": "http2responseWriter.FlushError"
},
{
"name": "http2responseWriter.Push"
},
{
"name": "http2responseWriter.SetReadDeadline"
},
{
"name": "http2responseWriter.SetWriteDeadline"
},
{
"name": "http2responseWriter.Write"
},
{
"name": "http2responseWriter.WriteHeader"
},
{
"name": "http2responseWriter.WriteString"
},
{
"name": "http2roundRobinWriteScheduler.OpenStream"
},
{
"name": "http2roundRobinWriteScheduler.Pop"
},
{
"name": "http2serverConn.CloseConn"
},
{
"name": "http2serverConn.Flush"
},
{
"name": "http2stickyErrWriter.Write"
},
{
"name": "http2transportResponseBody.Close"
},
{
"name": "http2transportResponseBody.Read"
},
{
"name": "http2unencryptedTransport.RoundTrip"
},
{
"name": "http2writeData.String"
},
{
"name": "initALPNRequest.ServeHTTP"
},
{
"name": "loggingConn.Close"
},
{
"name": "loggingConn.Read"
},
{
"name": "loggingConn.Write"
},
{
"name": "maxBytesReader.Close"
},
{
"name": "maxBytesReader.Read"
},
{
"name": "onceCloseListener.Close"
},
{
"name": "persistConn.Read"
},
{
"name": "persistConnWriter.ReadFrom"
},
{
"name": "persistConnWriter.Write"
},
{
"name": "populateResponse.Write"
},
{
"name": "populateResponse.WriteHeader"
},
{
"name": "readTrackingBody.Close"
},
{
"name": "readTrackingBody.Read"
},
{
"name": "readWriteCloserBody.CloseWrite"
},
{
"name": "readWriteCloserBody.Read"
},
{
"name": "redirectHandler.ServeHTTP"
},
{
"name": "response.Flush"
},
{
"name": "response.FlushError"
},
{
"name": "response.Hijack"
},
{
"name": "response.ReadFrom"
},
{
"name": "response.Write"
},
{
"name": "response.WriteHeader"
},
{
"name": "response.WriteString"
},
{
"name": "serverHandler.ServeHTTP"
},
{
"name": "socksDialer.DialWithConn"
},
{
"name": "socksUsernamePassword.Authenticate"
},
{
"name": "stringWriter.WriteString"
},
{
"name": "timeoutHandler.ServeHTTP"
},
{
"name": "timeoutWriter.Write"
},
{
"name": "timeoutWriter.WriteHeader"
},
{
"name": "transportReadFromServerError.Error"
},
{
"name": "unencryptedHTTP2Request.ServeHTTP"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http/internal/http2",
"product": "net/http/internal/http2",
"programRoutines": [
{
"name": "outflow.add"
},
{
"name": "outflow.available"
},
{
"name": "outflow.setConnFlow"
},
{
"name": "outflow.take"
},
{
"name": "Server.serveConn"
},
{
"name": "serverConn.newStream"
},
{
"name": "serverConn.processSettingInitialWindowSize"
},
{
"name": "serverConn.processWindowUpdate"
},
{
"name": "serverConn.scheduleFrameWrite"
},
{
"name": "ClientConn.addStreamLocked"
},
{
"name": "Transport.newClientConn"
},
{
"name": "clientConnReadLoop.processSettingsNoWrite"
},
{
"name": "clientConnReadLoop.processWindowUpdate"
},
{
"name": "clientConnReadLoop.streamByID"
},
{
"name": "clientStream.awaitFlowControl"
},
{
"name": "clientStream.cleanupWriteRequest"
},
{
"name": "FrameWriteRequest.Consume"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "NetHTTPClientConn.Close"
},
{
"name": "NetHTTPClientConn.Ping"
},
{
"name": "NetHTTPClientConn.RoundTrip"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.GracefulShutdown"
},
{
"name": "Server.ServeConn"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "Transport.AddConn"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "priorityWriteSchedulerRFC9218.Pop"
},
{
"name": "requestBody.Close"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "roundRobinWriteScheduler.Pop"
},
{
"name": "serve400Handler.ServeHTTP"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/http2",
"product": "golang.org/x/net/http2",
"programRoutines": [
{
"name": "outflow.add"
},
{
"name": "outflow.available"
},
{
"name": "outflow.setConnFlow"
},
{
"name": "outflow.take"
},
{
"name": "Server.serveConn"
},
{
"name": "serverConn.newStream"
},
{
"name": "serverConn.processSettingInitialWindowSize"
},
{
"name": "serverConn.processWindowUpdate"
},
{
"name": "serverConn.scheduleFrameWrite"
},
{
"name": "ClientConn.addStreamLocked"
},
{
"name": "Transport.newClientConn"
},
{
"name": "clientConnReadLoop.processSettingsNoWrite"
},
{
"name": "clientConnReadLoop.processWindowUpdate"
},
{
"name": "clientConnReadLoop.streamByID"
},
{
"name": "clientStream.awaitFlowControl"
},
{
"name": "clientStream.cleanupWriteRequest"
},
{
"name": "FrameWriteRequest.Consume"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "ConfigureServer"
},
{
"name": "ConfigureTransport"
},
{
"name": "ConfigureTransports"
},
{
"name": "ConnectionError.Error"
},
{
"name": "ErrCode.String"
},
{
"name": "FrameHeader.String"
},
{
"name": "FrameType.String"
},
{
"name": "FrameWriteRequest.String"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "GoAwayError.Error"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.ServeConn"
},
{
"name": "Setting.String"
},
{
"name": "SettingID.String"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "StreamError.Error"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "connError.Error"
},
{
"name": "dataBuffer.Read"
},
{
"name": "duplicatePseudoHeaderError.Error"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "headerFieldNameError.Error"
},
{
"name": "headerFieldValueError.Error"
},
{
"name": "netHTTPClientConn.Close"
},
{
"name": "netHTTPClientConn.RoundTrip"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "noDialH2RoundTripper.NewClientConn"
},
{
"name": "noDialH2RoundTripper.RoundTrip"
},
{
"name": "pipe.Read"
},
{
"name": "priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "priorityWriteSchedulerRFC7540.Pop"
},
{
"name": "priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "priorityWriteSchedulerRFC9218.Pop"
},
{
"name": "pseudoHeaderError.Error"
},
{
"name": "randomWriteScheduler.Pop"
},
{
"name": "requestBody.Close"
},
{
"name": "requestBody.Read"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.SetReadDeadline"
},
{
"name": "responseWriter.SetWriteDeadline"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "roundRobinWriteScheduler.OpenStream"
},
{
"name": "roundRobinWriteScheduler.Pop"
},
{
"name": "serverConn.CloseConn"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
},
{
"name": "unencryptedTransport.RoundTrip"
},
{
"name": "writeData.String"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.60.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Ciolek (https://ciolek.dev)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:59.530Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847186"
},
{
"url": "https://go.dev/cl/847308"
},
{
"url": "https://go.dev/issue/81742"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6611"
}
],
"title": "Excessive CPU consumption from repeated initial window changes in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-78669",
"datePublished": "2026-10-08T22:53:59.530Z",
"dateReserved": "2026-08-24T23:36:15.739Z",
"dateUpdated": "2026-10-09T16:32:57.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78660 (GCVE-0-2026-78660)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:23
VLAI
EPSS
VEX
Title
HTTP/2 transport accepts malformed framing-related headers in net/http
Summary
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:21 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
|
|
| Go standard library | net/http/internal/http2 |
Affected:
1.27.0-0 , < 1.27.2
(semver)
|
|
| golang.org/x/net | golang.org/x/net/http2 |
Affected:
0 , < 0.60.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:21:51.217328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:23:56.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "http2clientConnReadLoop.handleResponse"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Get"
},
{
"name": "Head"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
},
{
"name": "http2Transport.NewClientConn"
},
{
"name": "http2Transport.RoundTrip"
},
{
"name": "http2Transport.RoundTripOpt"
},
{
"name": "http2clientConnPool.GetClientConn"
},
{
"name": "http2noDialClientConnPool.GetClientConn"
},
{
"name": "http2noDialH2RoundTripper.NewClientConn"
},
{
"name": "http2noDialH2RoundTripper.RoundTrip"
},
{
"name": "http2unencryptedTransport.RoundTrip"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http/internal/http2",
"product": "net/http/internal/http2",
"programRoutines": [
{
"name": "clientConnReadLoop.handleResponse"
},
{
"name": "Transport.AddConn"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "noDialClientConnPool.GetClientConn"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/http2",
"product": "golang.org/x/net/http2",
"programRoutines": [
{
"name": "clientConnReadLoop.handleResponse"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "noDialH2RoundTripper.NewClientConn"
},
{
"name": "noDialH2RoundTripper.RoundTrip"
},
{
"name": "unencryptedTransport.RoundTrip"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.60.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TJ Barton"
}
],
"descriptions": [
{
"lang": "en",
"value": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:59.334Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/835145"
},
{
"url": "https://go.dev/cl/836385"
},
{
"url": "https://go.dev/issue/81115"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6610"
}
],
"title": "HTTP/2 transport accepts malformed framing-related headers in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-78660",
"datePublished": "2026-10-08T22:53:59.334Z",
"dateReserved": "2026-08-24T23:36:15.738Z",
"dateUpdated": "2026-10-09T16:23:56.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78667 (GCVE-0-2026-78667)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:12
VLAI
EPSS
VEX
Title
Lack of limit on size of parsed Range headers in net/http
Summary
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:12 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:12:49.383383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:12:53.569Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "parseRange"
},
{
"name": "ServeContent"
},
{
"name": "ServeFile"
},
{
"name": "ServeFileFS"
},
{
"name": "fileHandler.ServeHTTP"
},
{
"name": "fileTransport.RoundTrip"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Ciolek (https://ciolek.dev)"
}
],
"descriptions": [
{
"lang": "en",
"value": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:59.148Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847309"
},
{
"url": "https://go.dev/issue/81858"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6609"
}
],
"title": "Lack of limit on size of parsed Range headers in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-78667",
"datePublished": "2026-10-08T22:53:59.148Z",
"dateReserved": "2026-08-24T23:36:15.738Z",
"dateUpdated": "2026-10-09T16:12:53.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94440 (GCVE-0-2026-94440)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:09
VLAI
EPSS
VEX
Title
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Summary
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:09 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/textproto |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
|
| Go standard library | mime/multipart |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-94440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:09:04.864512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:09:59.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/textproto",
"product": "net/textproto",
"programRoutines": [
{
"name": "readMIMEHeader"
},
{
"name": "Reader.readContinuedLineSlice"
},
{
"name": "Reader.ReadContinuedLine"
},
{
"name": "Reader.ReadContinuedLineBytes"
},
{
"name": "Reader.ReadMIMEHeader"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "mime/multipart",
"product": "mime/multipart",
"programRoutines": [
{
"name": "Part.populateHeaders"
},
{
"name": "Reader.readForm"
},
{
"name": "Reader.NextPart"
},
{
"name": "Reader.NextRawPart"
},
{
"name": "Reader.ReadForm"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Ciolek (https://ciolek.dev)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:58.959Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847307"
},
{
"url": "https://go.dev/issue/81741"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6608"
}
],
"title": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-94440",
"datePublished": "2026-10-08T22:53:58.959Z",
"dateReserved": "2026-09-21T16:43:04.757Z",
"dateUpdated": "2026-10-09T16:09:59.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97031 (GCVE-0-2026-97031)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 15:59
VLAI
EPSS
VEX
Title
Reject malformed ECH outer extension references in crypto/tls
Summary
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 15:59 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | crypto/tls |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97031",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T15:59:09.530145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:59:17.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "crypto/tls",
"product": "crypto/tls",
"programRoutines": [
{
"name": "decodeInnerClientHello"
},
{
"name": "Conn.Handshake"
},
{
"name": "Conn.HandshakeContext"
},
{
"name": "Conn.Read"
},
{
"name": "Conn.Write"
},
{
"name": "Dial"
},
{
"name": "DialWithDialer"
},
{
"name": "Dialer.Dial"
},
{
"name": "Dialer.DialContext"
},
{
"name": "QUICConn.Start"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-405: Asymmetric Resource Consumption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:58.775Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847312"
},
{
"url": "https://go.dev/issue/81855"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6607"
}
],
"title": "Reject malformed ECH outer extension references in crypto/tls"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97031",
"datePublished": "2026-10-08T22:53:58.775Z",
"dateReserved": "2026-09-23T23:03:36.988Z",
"dateUpdated": "2026-10-09T15:59:17.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56866 (GCVE-0-2026-56866)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 15:54
VLAI
EPSS
VEX
Title
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
Summary
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 15:53 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
|
| Go standard library | net/http/httputil |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T15:53:00.591143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:54:59.009Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "persistConn.readLoop"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Get"
},
{
"name": "Head"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http/httputil",
"product": "net/http/httputil",
"programRoutines": [
{
"name": "ReverseProxy.ServeHTTP"
},
{
"name": "DumpRequestOut"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Xclow3n (Rajat Raghav)"
}
],
"descriptions": [
{
"lang": "en",
"value": "When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:58.586Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847306"
},
{
"url": "https://go.dev/issue/81740"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6605"
}
],
"title": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56866",
"datePublished": "2026-10-08T22:53:58.586Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-10-09T15:54:59.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56857 (GCVE-0-2026-56857)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 15:36
VLAI
EPSS
VEX
Title
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Summary
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 15:35 UTC
CWE
- CWE-1386 - Insecure Operation on Windows Junction / Mount Point
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | os |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
|
| Go standard library | internal/syscall/windows |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T15:35:58.663117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1386",
"description": "CWE-1386 Insecure Operation on Windows Junction / Mount Point",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:36:01.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "os",
"platforms": [
"windows"
],
"product": "os",
"programRoutines": [
{
"name": "Root.Mkdir"
},
{
"name": "doInRoot"
},
{
"name": "rootMkdirAll"
},
{
"name": "Root.Chmod"
},
{
"name": "Root.Chown"
},
{
"name": "Root.Chtimes"
},
{
"name": "Root.Lchown"
},
{
"name": "Root.Link"
},
{
"name": "Root.MkdirAll"
},
{
"name": "Root.Remove"
},
{
"name": "Root.RemoveAll"
},
{
"name": "Root.Rename"
},
{
"name": "Root.Symlink"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "internal/syscall/windows",
"platforms": [
"windows"
],
"product": "internal/syscall/windows",
"programRoutines": [
{
"name": "Mkdirat"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Daniele Ballarini"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1386: Insecure Operation on Windows Junction / Mount Point",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:58.387Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847305"
},
{
"url": "https://go.dev/issue/81739"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6604"
}
],
"title": "Root.Mkdir(All) can follow junctions out of the root on Windows in os"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56857",
"datePublished": "2026-10-08T22:53:58.387Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-10-09T15:36:01.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78659 (GCVE-0-2026-78659)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 15:34
VLAI
EPSS
VEX
Title
HTTP/2 server memory exhaustion due to Trailer headers in net/http
Summary
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 15:27 UTC
CWE
- CWE-405 - Asymmetric Resource Consumption (Amplification)
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.26.9
(semver)
|
|
| Go standard library | net/http/internal/http2 |
Affected:
1.27.0-0 , < 1.27.2
(semver)
|
|
| golang.org/x/net | golang.org/x/net/http2 |
Affected:
0 , < 0.60.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T15:27:33.510545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:34:24.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "http2Framer.readMetaFrame"
},
{
"name": "CanonicalHeaderKey"
},
{
"name": "Client.CloseIdleConnections"
},
{
"name": "Client.Do"
},
{
"name": "Client.Get"
},
{
"name": "Client.Head"
},
{
"name": "Client.Post"
},
{
"name": "Client.PostForm"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "Cookie.String"
},
{
"name": "Cookie.Valid"
},
{
"name": "CrossOriginProtection.AddInsecureBypassPattern"
},
{
"name": "CrossOriginProtection.AddTrustedOrigin"
},
{
"name": "CrossOriginProtection.Check"
},
{
"name": "Dir.Open"
},
{
"name": "Error"
},
{
"name": "Get"
},
{
"name": "Handle"
},
{
"name": "HandleFunc"
},
{
"name": "HandlerFunc.ServeHTTP"
},
{
"name": "Head"
},
{
"name": "Header.Add"
},
{
"name": "Header.Del"
},
{
"name": "Header.Get"
},
{
"name": "Header.Set"
},
{
"name": "Header.Values"
},
{
"name": "Header.Write"
},
{
"name": "Header.WriteSubset"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "NewRequest"
},
{
"name": "NewRequestWithContext"
},
{
"name": "NotFound"
},
{
"name": "ParseCookie"
},
{
"name": "ParseSetCookie"
},
{
"name": "ParseTime"
},
{
"name": "Post"
},
{
"name": "PostForm"
},
{
"name": "ProxyFromEnvironment"
},
{
"name": "ReadRequest"
},
{
"name": "ReadResponse"
},
{
"name": "Redirect"
},
{
"name": "Request.AddCookie"
},
{
"name": "Request.BasicAuth"
},
{
"name": "Request.Cookie"
},
{
"name": "Request.Cookies"
},
{
"name": "Request.CookiesNamed"
},
{
"name": "Request.FormFile"
},
{
"name": "Request.FormValue"
},
{
"name": "Request.MultipartReader"
},
{
"name": "Request.ParseForm"
},
{
"name": "Request.ParseMultipartForm"
},
{
"name": "Request.PostFormValue"
},
{
"name": "Request.Referer"
},
{
"name": "Request.SetBasicAuth"
},
{
"name": "Request.UserAgent"
},
{
"name": "Request.Write"
},
{
"name": "Request.WriteProxy"
},
{
"name": "Response.Cookies"
},
{
"name": "Response.Location"
},
{
"name": "Response.Write"
},
{
"name": "ResponseController.EnableFullDuplex"
},
{
"name": "ResponseController.Flush"
},
{
"name": "ResponseController.Hijack"
},
{
"name": "ResponseController.SetReadDeadline"
},
{
"name": "ResponseController.SetWriteDeadline"
},
{
"name": "Serve"
},
{
"name": "ServeContent"
},
{
"name": "ServeFile"
},
{
"name": "ServeFileFS"
},
{
"name": "ServeMux.Handle"
},
{
"name": "ServeMux.HandleFunc"
},
{
"name": "ServeMux.ServeHTTP"
},
{
"name": "ServeTLS"
},
{
"name": "Server.Close"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
},
{
"name": "Server.SetKeepAlivesEnabled"
},
{
"name": "Server.Shutdown"
},
{
"name": "SetCookie"
},
{
"name": "Transport.CancelRequest"
},
{
"name": "Transport.Clone"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "body.Close"
},
{
"name": "body.Read"
},
{
"name": "bodyEOFSignal.Close"
},
{
"name": "bodyEOFSignal.Read"
},
{
"name": "bodyLocked.Read"
},
{
"name": "bufioFlushWriter.Write"
},
{
"name": "cancelTimerBody.Close"
},
{
"name": "cancelTimerBody.Read"
},
{
"name": "checkConnErrorWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "connReader.Read"
},
{
"name": "connectMethodKey.String"
},
{
"name": "expectContinueReader.Close"
},
{
"name": "expectContinueReader.Read"
},
{
"name": "extraHeader.Write"
},
{
"name": "fileHandler.ServeHTTP"
},
{
"name": "fileTransport.RoundTrip"
},
{
"name": "globalOptionsHandler.ServeHTTP"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "http1ClientConn.Close"
},
{
"name": "http1ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Close"
},
{
"name": "http2ClientConn.Ping"
},
{
"name": "http2ClientConn.RoundTrip"
},
{
"name": "http2ClientConn.Shutdown"
},
{
"name": "http2ConnectionError.Error"
},
{
"name": "http2ErrCode.String"
},
{
"name": "http2FrameHeader.String"
},
{
"name": "http2FrameType.String"
},
{
"name": "http2FrameWriteRequest.String"
},
{
"name": "http2Framer.ReadFrame"
},
{
"name": "http2Framer.ReadFrameForHeader"
},
{
"name": "http2Framer.ReadFrameHeader"
},
{
"name": "http2Framer.WriteContinuation"
},
{
"name": "http2Framer.WriteData"
},
{
"name": "http2Framer.WriteDataPadded"
},
{
"name": "http2Framer.WriteGoAway"
},
{
"name": "http2Framer.WriteHeaders"
},
{
"name": "http2Framer.WritePing"
},
{
"name": "http2Framer.WritePriority"
},
{
"name": "http2Framer.WritePushPromise"
},
{
"name": "http2Framer.WriteRSTStream"
},
{
"name": "http2Framer.WriteRawFrame"
},
{
"name": "http2Framer.WriteSettings"
},
{
"name": "http2Framer.WriteSettingsAck"
},
{
"name": "http2Framer.WriteWindowUpdate"
},
{
"name": "http2GoAwayError.Error"
},
{
"name": "http2Server.ServeConn"
},
{
"name": "http2Setting.String"
},
{
"name": "http2SettingID.String"
},
{
"name": "http2SettingsFrame.ForeachSetting"
},
{
"name": "http2StreamError.Error"
},
{
"name": "http2Transport.CloseIdleConnections"
},
{
"name": "http2Transport.NewClientConn"
},
{
"name": "http2Transport.RoundTrip"
},
{
"name": "http2Transport.RoundTripOpt"
},
{
"name": "http2bufferedWriter.Flush"
},
{
"name": "http2bufferedWriter.Write"
},
{
"name": "http2bufferedWriterTimeoutWriter.Write"
},
{
"name": "http2chunkWriter.Write"
},
{
"name": "http2clientConnPool.GetClientConn"
},
{
"name": "http2connError.Error"
},
{
"name": "http2dataBuffer.Read"
},
{
"name": "http2duplicatePseudoHeaderError.Error"
},
{
"name": "http2gzipReader.Close"
},
{
"name": "http2gzipReader.Read"
},
{
"name": "http2headerFieldNameError.Error"
},
{
"name": "http2headerFieldValueError.Error"
},
{
"name": "http2netHTTPClientConn.Close"
},
{
"name": "http2netHTTPClientConn.RoundTrip"
},
{
"name": "http2noDialClientConnPool.GetClientConn"
},
{
"name": "http2noDialH2RoundTripper.NewClientConn"
},
{
"name": "http2noDialH2RoundTripper.RoundTrip"
},
{
"name": "http2pipe.Read"
},
{
"name": "http2priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "http2priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "http2priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "http2pseudoHeaderError.Error"
},
{
"name": "http2requestBody.Close"
},
{
"name": "http2requestBody.Read"
},
{
"name": "http2responseWriter.Flush"
},
{
"name": "http2responseWriter.FlushError"
},
{
"name": "http2responseWriter.Push"
},
{
"name": "http2responseWriter.SetReadDeadline"
},
{
"name": "http2responseWriter.SetWriteDeadline"
},
{
"name": "http2responseWriter.Write"
},
{
"name": "http2responseWriter.WriteHeader"
},
{
"name": "http2responseWriter.WriteString"
},
{
"name": "http2roundRobinWriteScheduler.OpenStream"
},
{
"name": "http2serverConn.CloseConn"
},
{
"name": "http2serverConn.Flush"
},
{
"name": "http2stickyErrWriter.Write"
},
{
"name": "http2transportResponseBody.Close"
},
{
"name": "http2transportResponseBody.Read"
},
{
"name": "http2unencryptedTransport.RoundTrip"
},
{
"name": "http2writeData.String"
},
{
"name": "initALPNRequest.ServeHTTP"
},
{
"name": "loggingConn.Close"
},
{
"name": "loggingConn.Read"
},
{
"name": "loggingConn.Write"
},
{
"name": "maxBytesReader.Close"
},
{
"name": "maxBytesReader.Read"
},
{
"name": "onceCloseListener.Close"
},
{
"name": "persistConn.Read"
},
{
"name": "persistConnWriter.ReadFrom"
},
{
"name": "persistConnWriter.Write"
},
{
"name": "populateResponse.Write"
},
{
"name": "populateResponse.WriteHeader"
},
{
"name": "readTrackingBody.Close"
},
{
"name": "readTrackingBody.Read"
},
{
"name": "readWriteCloserBody.CloseWrite"
},
{
"name": "readWriteCloserBody.Read"
},
{
"name": "redirectHandler.ServeHTTP"
},
{
"name": "response.Flush"
},
{
"name": "response.FlushError"
},
{
"name": "response.Hijack"
},
{
"name": "response.ReadFrom"
},
{
"name": "response.Write"
},
{
"name": "response.WriteHeader"
},
{
"name": "response.WriteString"
},
{
"name": "serverHandler.ServeHTTP"
},
{
"name": "socksDialer.DialWithConn"
},
{
"name": "socksUsernamePassword.Authenticate"
},
{
"name": "stringWriter.WriteString"
},
{
"name": "timeoutHandler.ServeHTTP"
},
{
"name": "timeoutWriter.Write"
},
{
"name": "timeoutWriter.WriteHeader"
},
{
"name": "transportReadFromServerError.Error"
},
{
"name": "unencryptedHTTP2Request.ServeHTTP"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http/internal/http2",
"product": "net/http/internal/http2",
"programRoutines": [
{
"name": "Framer.readMetaFrame"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "NetHTTPClientConn.Close"
},
{
"name": "NetHTTPClientConn.Ping"
},
{
"name": "NetHTTPClientConn.RoundTrip"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.GracefulShutdown"
},
{
"name": "Server.ServeConn"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "Transport.AddConn"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "requestBody.Close"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "serve400Handler.ServeHTTP"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/http2",
"product": "golang.org/x/net/http2",
"programRoutines": [
{
"name": "Framer.readMetaFrame"
},
{
"name": "ClientConn.Close"
},
{
"name": "ClientConn.Ping"
},
{
"name": "ClientConn.RoundTrip"
},
{
"name": "ClientConn.Shutdown"
},
{
"name": "ConfigureServer"
},
{
"name": "ConfigureTransport"
},
{
"name": "ConfigureTransports"
},
{
"name": "ConnectionError.Error"
},
{
"name": "ErrCode.String"
},
{
"name": "FrameHeader.String"
},
{
"name": "FrameType.String"
},
{
"name": "FrameWriteRequest.String"
},
{
"name": "Framer.ReadFrame"
},
{
"name": "Framer.ReadFrameForHeader"
},
{
"name": "Framer.ReadFrameHeader"
},
{
"name": "Framer.WriteContinuation"
},
{
"name": "Framer.WriteData"
},
{
"name": "Framer.WriteDataPadded"
},
{
"name": "Framer.WriteGoAway"
},
{
"name": "Framer.WriteHeaders"
},
{
"name": "Framer.WritePing"
},
{
"name": "Framer.WritePriority"
},
{
"name": "Framer.WritePriorityUpdate"
},
{
"name": "Framer.WritePushPromise"
},
{
"name": "Framer.WriteRSTStream"
},
{
"name": "Framer.WriteRawFrame"
},
{
"name": "Framer.WriteSettings"
},
{
"name": "Framer.WriteSettingsAck"
},
{
"name": "Framer.WriteWindowUpdate"
},
{
"name": "GoAwayError.Error"
},
{
"name": "ReadFrameHeader"
},
{
"name": "Server.ServeConn"
},
{
"name": "Setting.String"
},
{
"name": "SettingID.String"
},
{
"name": "SettingsFrame.ForeachSetting"
},
{
"name": "StreamError.Error"
},
{
"name": "Transport.CloseIdleConnections"
},
{
"name": "Transport.NewClientConn"
},
{
"name": "Transport.RoundTrip"
},
{
"name": "Transport.RoundTripOpt"
},
{
"name": "bufferedWriter.Flush"
},
{
"name": "bufferedWriter.Write"
},
{
"name": "bufferedWriterTimeoutWriter.Write"
},
{
"name": "chunkWriter.Write"
},
{
"name": "clientConnPool.GetClientConn"
},
{
"name": "connError.Error"
},
{
"name": "dataBuffer.Read"
},
{
"name": "duplicatePseudoHeaderError.Error"
},
{
"name": "gzipReader.Close"
},
{
"name": "gzipReader.Read"
},
{
"name": "headerFieldNameError.Error"
},
{
"name": "headerFieldValueError.Error"
},
{
"name": "netHTTPClientConn.Close"
},
{
"name": "netHTTPClientConn.RoundTrip"
},
{
"name": "noDialClientConnPool.GetClientConn"
},
{
"name": "noDialH2RoundTripper.NewClientConn"
},
{
"name": "noDialH2RoundTripper.RoundTrip"
},
{
"name": "pipe.Read"
},
{
"name": "priorityWriteSchedulerRFC7540.CloseStream"
},
{
"name": "priorityWriteSchedulerRFC7540.OpenStream"
},
{
"name": "priorityWriteSchedulerRFC9218.OpenStream"
},
{
"name": "pseudoHeaderError.Error"
},
{
"name": "requestBody.Close"
},
{
"name": "requestBody.Read"
},
{
"name": "responseWriter.Flush"
},
{
"name": "responseWriter.FlushError"
},
{
"name": "responseWriter.Push"
},
{
"name": "responseWriter.SetReadDeadline"
},
{
"name": "responseWriter.SetWriteDeadline"
},
{
"name": "responseWriter.Write"
},
{
"name": "responseWriter.WriteHeader"
},
{
"name": "responseWriter.WriteString"
},
{
"name": "roundRobinWriteScheduler.OpenStream"
},
{
"name": "serverConn.CloseConn"
},
{
"name": "serverConn.Flush"
},
{
"name": "stickyErrWriter.Write"
},
{
"name": "transportResponseBody.Close"
},
{
"name": "transportResponseBody.Read"
},
{
"name": "unencryptedTransport.RoundTrip"
},
{
"name": "writeData.String"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.60.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"value": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:58.192Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/847185"
},
{
"url": "https://go.dev/cl/847314"
},
{
"url": "https://go.dev/issue/81857"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6603"
}
],
"title": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-78659",
"datePublished": "2026-10-08T22:53:58.192Z",
"dateReserved": "2026-08-24T23:36:03.109Z",
"dateUpdated": "2026-10-09T15:34:24.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94447 (GCVE-0-2026-94447)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-08 22:53
VLAI
EPSS
VEX
Title
Checksum database bypass for golang.org/toolchain in cmd/go
Summary
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Severity
No CVSS data available.
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:57.974Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/840785"
},
{
"url": "https://go.dev/issue/81834"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6602"
}
],
"title": "Checksum database bypass for golang.org/toolchain in cmd/go"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-94447",
"datePublished": "2026-10-08T22:53:57.974Z",
"dateReserved": "2026-09-21T16:43:04.757Z",
"dateUpdated": "2026-10-08T22:53:57.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94444 (GCVE-0-2026-94444)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-08 22:53
VLAI
EPSS
VEX
Title
Checksum bypass for golang.org/fips140 in cmd/go
Summary
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Severity
No CVSS data available.
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:57.787Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/840685"
},
{
"url": "https://go.dev/issue/81833"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6601"
}
],
"title": "Checksum bypass for golang.org/fips140 in cmd/go"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-94444",
"datePublished": "2026-10-08T22:53:57.787Z",
"dateReserved": "2026-09-21T16:43:04.757Z",
"dateUpdated": "2026-10-08T22:53:57.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97030 (GCVE-0-2026-97030)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-08 22:53
VLAI
EPSS
VEX
Title
Recognize yield as regexp preceder keyword in html/template
Summary
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
Severity
No CVSS data available.
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | html/template |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "html/template",
"product": "html/template",
"programRoutines": [
{
"name": "nextJSCtx"
},
{
"name": "tJS"
},
{
"name": "Template.Execute"
},
{
"name": "Template.ExecuteTemplate"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A trusted template author may have previously written a valid template wherein the use of the \u0027yield\u0027 keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:57.597Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/840925"
},
{
"url": "https://go.dev/issue/81823"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6600"
}
],
"title": "Recognize yield as regexp preceder keyword in html/template"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97030",
"datePublished": "2026-10-08T22:53:57.597Z",
"dateReserved": "2026-09-23T23:03:01.995Z",
"dateUpdated": "2026-10-08T22:53:57.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94448 (GCVE-0-2026-94448)
Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-08 22:53
VLAI
EPSS
VEX
Title
Reset context tracking on consecutive template expressions in html/template
Summary
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Severity
No CVSS data available.
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | html/template |
Affected:
0 , < 1.26.9
(semver)
Affected: 1.27.0-0 , < 1.27.2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "html/template",
"product": "html/template",
"programRoutines": [
{
"name": "tJSTmpl"
},
{
"name": "Template.Execute"
},
{
"name": "Template.ExecuteTemplate"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T22:53:57.417Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/839866"
},
{
"url": "https://go.dev/issue/81821"
},
{
"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6599"
}
],
"title": "Reset context tracking on consecutive template expressions in html/template"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-94448",
"datePublished": "2026-10-08T22:53:57.417Z",
"dateReserved": "2026-09-21T16:43:04.758Z",
"dateUpdated": "2026-10-08T22:53:57.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56851 (GCVE-0-2026-56851)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:46 – Updated: 2026-10-08 13:49
VLAI
EPSS
VEX
Title
Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
Summary
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 13:48 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/text | golang.org/x/text/secure/precis |
Affected:
0 , < 0.41.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T13:48:57.351617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:49:06.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/text/secure/precis",
"product": "golang.org/x/text/secure/precis",
"programRoutines": [
{
"name": "nickAdditionalMapping.Transform"
},
{
"name": "Profile.Append"
},
{
"name": "Profile.AppendCompareKey"
},
{
"name": "Profile.Bytes"
},
{
"name": "Profile.Compare"
},
{
"name": "Profile.CompareKey"
},
{
"name": "Profile.NewTransformer"
},
{
"name": "Profile.String"
},
{
"name": "Transformer.Bytes"
},
{
"name": "Transformer.String"
},
{
"name": "Transformer.Transform"
}
],
"vendor": "golang.org/x/text",
"versions": [
{
"lessThan": "0.41.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Omkhar Arasaratnam (GitHub: omkhar)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-787: Out-of-bounds Write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:46:35.620Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/793360"
},
{
"url": "https://go.dev/issue/80112"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6629"
}
],
"title": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56851",
"datePublished": "2026-10-07T17:46:35.620Z",
"dateReserved": "2026-06-23T15:10:49.352Z",
"dateUpdated": "2026-10-08T13:49:06.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94445 (GCVE-0-2026-94445)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:43 – Updated: 2026-09-25 17:08
VLAI
EPSS
VEX
Title
Malicious user input may lead to RCE in golang.org/x/playground
Summary
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.
Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME.
Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself.
This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 17:08 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/playground | golang.org/x/playground |
Affected:
0 , < 0.0.0-20260924211604-6d73cff14c17
(semver)
|
Date Public
2026-09-24 21:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-94445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T17:08:10.870774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T17:08:14.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/playground",
"product": "golang.org/x/playground",
"vendor": "golang.org/x/playground",
"versions": [
{
"lessThan": "0.0.0-20260924211604-6d73cff14c17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "splitline (@splitline) from DEVCORE Research Team"
}
],
"datePublic": "2026-09-24T21:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA malicious txtar could escape the intended execution context and force arbitrary writes to the playground host\u0027s trusted filesystem.\u003c/p\u003e\u003cp\u003eDisjointly, one of the three possible paths to invoke\u0026nbsp;\u003ccode\u003ego vet\u003c/code\u003e\u0026nbsp;on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host\u0027s $HOME.\u003c/p\u003e\u003cp\u003eTogether, a well-crafted go env file and the\u0026nbsp;\u003ccode\u003ego vet\u003c/code\u003e\u0026nbsp;invocation could lead to remote code execution in the playground host itself.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis does not affect users of go.dev/play directly; however, it may affect\u0026nbsp;independent deployments of golang.org/x/playground.\u003c/p\u003e"
}
],
"value": "A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host\u0027s trusted filesystem.\n\n\n\nDisjointly, one of the three possible paths to invoke\u00a0go vet\u00a0on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host\u0027s $HOME.\n\n\n\nTogether, a well-crafted go env file and the\u00a0go vet\u00a0invocation could lead to remote code execution in the playground host itself.\n\n\n\n\nThis does not affect users of go.dev/play directly; however, it may affect\u00a0independent deployments of golang.org/x/playground."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:43:06.941Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/81737"
},
{
"url": "https://go.dev/cl/838485"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Malicious user input may lead to RCE in golang.org/x/playground",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-94445",
"datePublished": "2026-09-25T16:43:06.941Z",
"dateReserved": "2026-09-21T16:43:04.757Z",
"dateUpdated": "2026-09-25T17:08:14.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56855 (GCVE-0-2026-56855)
Vulnerability from cvelistv5 – Published: 2026-09-02 19:37 – Updated: 2026-09-03 14:14
VLAI
EPSS
VEX
Title
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
Summary
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 14:13 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh |
Affected:
0 , < 0.56.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T14:13:54.397574Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:14:40.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/crypto/ssh",
"product": "golang.org/x/crypto/ssh",
"programRoutines": [
{
"name": "channel.handlePacket"
},
{
"name": "Dial"
},
{
"name": "NewClientConn"
},
{
"name": "NewControlClientConn"
},
{
"name": "NewServerConn"
}
],
"vendor": "golang.org/x/crypto",
"versions": [
{
"lessThan": "0.56.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Will Mortensen"
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T19:37:05.807Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/81317"
},
{
"url": "https://go.dev/cl/826524"
},
{
"url": "https://groups.google.com/g/golang-announce/c/1y3fb2np35U"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6355"
}
],
"title": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56855",
"datePublished": "2026-09-02T19:37:05.807Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-09-03T14:14:40.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78662 (GCVE-0-2026-78662)
Vulnerability from cvelistv5 – Published: 2026-09-02 19:37 – Updated: 2026-09-03 13:20
VLAI
EPSS
VEX
Title
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
Summary
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 13:19 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh |
Affected:
0 , < 0.56.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T13:19:47.340520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T13:20:12.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/crypto/ssh",
"product": "golang.org/x/crypto/ssh",
"programRoutines": [
{
"name": "channel.handlePacket"
},
{
"name": "channel.responseMessageReceived"
},
{
"name": "channel.Accept"
},
{
"name": "Dial"
},
{
"name": "NewClientConn"
},
{
"name": "NewControlClientConn"
},
{
"name": "NewServerConn"
}
],
"vendor": "golang.org/x/crypto",
"versions": [
{
"lessThan": "0.56.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Will Mortensen"
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, a channel registered in the mux\u0027s chanList is not usable until it is established. A malicious peer was able flood the channel\u0027s incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T19:37:05.741Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/81316"
},
{
"url": "https://go.dev/cl/826504"
},
{
"url": "https://groups.google.com/g/golang-announce/c/1y3fb2np35U"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6354"
}
],
"title": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-78662",
"datePublished": "2026-09-02T19:37:05.741Z",
"dateReserved": "2026-08-24T23:36:15.738Z",
"dateUpdated": "2026-09-03T13:20:12.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56854 (GCVE-0-2026-56854)
Vulnerability from cvelistv5 – Published: 2026-08-28 15:14 – Updated: 2026-08-28 20:17
VLAI
EPSS
VEX
Title
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Summary
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 20:16 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh |
Affected:
0 , < 0.55.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:16:07.248758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:17:17.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/crypto/ssh",
"product": "golang.org/x/crypto/ssh",
"programRoutines": [
{
"name": "connection.serverAuthenticate"
},
{
"name": "NewServerConn"
}
],
"vendor": "golang.org/x/crypto",
"versions": [
{
"lessThan": "0.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Longwei Wang (@gn00295120)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863: Incorrect Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:14:26.918Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80213"
},
{
"url": "https://go.dev/cl/797040"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6303"
}
],
"title": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56854",
"datePublished": "2026-08-28T15:14:26.918Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-08-28T20:17:17.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46603 (GCVE-0-2026-46603)
Vulnerability from cvelistv5 – Published: 2026-08-14 16:38 – Updated: 2026-08-14 19:36
VLAI
EPSS
VEX
Title
Excessive memory allocation during VP8L decoding in golang.org/x/image
Summary
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 19:36 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/vp8l |
Affected:
0 , < 0.45.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T19:36:26.966791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T19:36:57.436Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/vp8l",
"product": "golang.org/x/image/vp8l",
"programRoutines": [
{
"name": "decoder.decodeHuffmanGroups"
},
{
"name": "decoder.decodeHuffmanTree"
},
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.45.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Daniele Ballarini"
}
],
"descriptions": [
{
"lang": "en",
"value": "VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:38:16.879Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80069"
},
{
"url": "https://go.dev/cl/793460"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6222"
}
],
"title": "Excessive memory allocation during VP8L decoding in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46603",
"datePublished": "2026-08-14T16:38:16.879Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-08-14T19:36:57.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56860 (GCVE-0-2026-56860)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14
VLAI
EPSS
VEX
Title
Avoid quadratic complexity in resolvePath in net/url
Summary
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:14 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/url |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:14:34.601382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:14:39.166Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/url",
"product": "net/url",
"programRoutines": [
{
"name": "resolvePath"
},
{
"name": "URL.Parse"
},
{
"name": "URL.ResolveReference"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.731Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/803681"
},
{
"url": "https://go.dev/issue/80494"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6218"
}
],
"title": "Avoid quadratic complexity in resolvePath in net/url"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56860",
"datePublished": "2026-08-13T21:58:53.731Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-08-14T16:14:39.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56864 (GCVE-0-2026-56864)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16
VLAI
EPSS
VEX
Title
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Summary
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:16 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
|
| golang.org/x/mod | golang.org/x/mod/sumdb |
Affected:
0 , < 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:16:37.911009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:16:42.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/mod/sumdb",
"product": "golang.org/x/mod/sumdb",
"programRoutines": [
{
"name": "Client.Lookup"
}
],
"vendor": "golang.org/x/mod",
"versions": [
{
"lessThan": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "mundur"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.605Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80745"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/815000"
},
{
"url": "https://go.dev/cl/815020"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6180"
}
],
"title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56864",
"datePublished": "2026-08-13T21:58:53.605Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-08-14T16:16:42.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56865 (GCVE-0-2026-56865)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:34
VLAI
EPSS
VEX
Title
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Summary
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:33 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
|
| golang.org/x/mod | golang.org/x/mod/sumdb/tlog |
Affected:
0 , < 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:33:28.143873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:34:17.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/mod/sumdb/tlog",
"product": "golang.org/x/mod/sumdb/tlog",
"programRoutines": [
{
"name": "tileHashReader.ReadHashes"
}
],
"vendor": "golang.org/x/mod",
"versions": [
{
"lessThan": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Filippo Valsorda (Geomys)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.475Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80744"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/814960"
},
{
"url": "https://go.dev/cl/815020"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6179"
}
],
"title": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56865",
"datePublished": "2026-08-13T21:58:53.475Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-08-14T15:34:17.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56858 (GCVE-0-2026-56858)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:32
VLAI
EPSS
VEX
Title
Fix Javascript regexp context tracking in html/template
Summary
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | html/template |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:31:30.140536Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:32:29.852Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "html/template",
"product": "html/template",
"programRoutines": [
{
"name": "tJS"
},
{
"name": "Template.Execute"
},
{
"name": "Template.ExecuteTemplate"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ali Sherif"
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.354Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80435"
},
{
"url": "https://go.dev/cl/807100"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6091"
}
],
"title": "Fix Javascript regexp context tracking in html/template"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56858",
"datePublished": "2026-08-13T21:58:53.354Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-08-14T15:32:29.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56862 (GCVE-0-2026-56862)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:29
VLAI
EPSS
VEX
Title
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Summary
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:27 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | crypto/tls |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:27:34.651997Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:29:41.741Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "crypto/tls",
"product": "crypto/tls",
"programRoutines": [
{
"name": "Conn.readRecordOrCCS"
},
{
"name": "Conn.Handshake"
},
{
"name": "Conn.HandshakeContext"
},
{
"name": "Conn.Read"
},
{
"name": "Conn.Write"
},
{
"name": "Dial"
},
{
"name": "DialWithDialer"
},
{
"name": "Dialer.Dial"
},
{
"name": "Dialer.DialContext"
},
{
"name": "QUICConn.HandleData"
},
{
"name": "QUICConn.Start"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Qi Deng of Aurascape.ai"
}
],
"descriptions": [
{
"lang": "en",
"value": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.216Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80528"
},
{
"url": "https://go.dev/cl/804261"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6090"
}
],
"title": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56862",
"datePublished": "2026-08-13T21:58:53.216Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-08-14T15:29:41.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56853 (GCVE-0-2026-56853)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:23
VLAI
EPSS
VEX
Title
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Summary
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:22 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/http |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:22:45.475320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:23:18.680Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/http",
"product": "net/http",
"programRoutines": [
{
"name": "conn.readRequest"
},
{
"name": "conn.serve"
},
{
"name": "ListenAndServe"
},
{
"name": "ListenAndServeTLS"
},
{
"name": "Serve"
},
{
"name": "ServeTLS"
},
{
"name": "Server.ListenAndServe"
},
{
"name": "Server.ListenAndServeTLS"
},
{
"name": "Server.Serve"
},
{
"name": "Server.ServeTLS"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.092Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80205"
},
{
"url": "https://go.dev/cl/795540"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6089"
}
],
"title": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56853",
"datePublished": "2026-08-13T21:58:53.092Z",
"dateReserved": "2026-06-23T15:10:49.352Z",
"dateUpdated": "2026-08-14T15:23:18.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56859 (GCVE-0-2026-56859)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:21
VLAI
EPSS
VEX
Title
Add recursion depth guard during decode in encoding/xml
Summary
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:21 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | encoding/xml |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:21:09.615961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:21:46.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "encoding/xml",
"product": "encoding/xml",
"programRoutines": [
{
"name": "Decoder.push"
},
{
"name": "Decoder.pop"
},
{
"name": "Decoder.RawToken"
},
{
"name": "Decoder.unmarshalPath"
},
{
"name": "Decoder.unmarshal"
},
{
"name": "Decoder.Decode"
},
{
"name": "Decoder.DecodeElement"
},
{
"name": "Decoder.Skip"
},
{
"name": "Decoder.Token"
},
{
"name": "Unmarshal"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:52.959Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80481"
},
{
"url": "https://go.dev/cl/803320"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6088"
}
],
"title": "Add recursion depth guard during decode in encoding/xml"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56859",
"datePublished": "2026-08-13T21:58:52.959Z",
"dateReserved": "2026-06-23T15:10:49.353Z",
"dateUpdated": "2026-08-14T15:21:46.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33818 (GCVE-0-2026-33818)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-10-14 04:25
VLAI
EPSS
VEX
Title
Enforce maximum recursion depth in encoding/asn1
Summary
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:11 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | encoding/asn1 |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-33818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:11:19.904646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:12:34.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "encoding/asn1",
"product": "encoding/asn1",
"programRoutines": [
{
"name": "parseSequenceOf"
},
{
"name": "parseField"
},
{
"name": "UnmarshalWithParams"
},
{
"name": "Unmarshal"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Marwan Atia (marwansamir688@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T04:25:05.928Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80405"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/814980"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5972"
}
],
"title": "Enforce maximum recursion depth in encoding/asn1"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-33818",
"datePublished": "2026-08-13T21:58:52.821Z",
"dateReserved": "2026-03-23T20:35:32.815Z",
"dateUpdated": "2026-10-14T04:25:05.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56852 (GCVE-0-2026-56852)
Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57
VLAI
EPSS
VEX
Title
Infinite loop on invalid input in golang.org/x/text
Summary
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:26 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/text | golang.org/x/text/unicode/norm |
Affected:
0 , < 0.39.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:26:14.918983Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:26:20.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/text/unicode/norm",
"product": "golang.org/x/text/unicode/norm",
"programRoutines": [
{
"name": "nextComposed"
},
{
"name": "Form.Append"
},
{
"name": "Form.AppendString"
},
{
"name": "Form.Bytes"
},
{
"name": "Form.FirstBoundary"
},
{
"name": "Form.FirstBoundaryInString"
},
{
"name": "Form.IsNormal"
},
{
"name": "Form.IsNormalString"
},
{
"name": "Form.LastBoundary"
},
{
"name": "Form.NextBoundary"
},
{
"name": "Form.NextBoundaryInString"
},
{
"name": "Form.Properties"
},
{
"name": "Form.PropertiesString"
},
{
"name": "Form.QuickSpan"
},
{
"name": "Form.QuickSpanString"
},
{
"name": "Form.Span"
},
{
"name": "Form.SpanString"
},
{
"name": "Form.String"
},
{
"name": "Form.Transform"
},
{
"name": "Iter.Init"
},
{
"name": "Iter.InitString"
},
{
"name": "Iter.Next"
},
{
"name": "Iter.Seek"
},
{
"name": "normReader.Read"
},
{
"name": "normWriter.Write"
}
],
"vendor": "golang.org/x/text",
"versions": [
{
"lessThan": "0.39.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Viky Choi (\"vikychoi\" on GitHub)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:57:54.703Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80142"
},
{
"url": "https://go.dev/cl/794100"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"title": "Infinite loop on invalid input in golang.org/x/text"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56852",
"datePublished": "2026-07-21T19:18:59.951Z",
"dateReserved": "2026-06-23T15:10:49.352Z",
"dateUpdated": "2026-08-10T22:57:54.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}