CVE-2026-56853

HIGH7.5Denial of service

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products

Go standard library / net/http0 – 1.25.13
Go standard library / net/http1.26.0-0 – 1.26.6
Go standard library / net/http1.27.0-0 – 1.27.0-rc.3

References

MISChttps://go.dev/issue/80205
MISChttps://go.dev/cl/795540
MISChttps://groups.google.com/g/golang-announce/c/94pEornpRlI
MISChttps://pkg.go.dev/vuln/GO-2026-6089

Updated 20m ago · 8 sources