CVE-2026-78669

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78669", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-08-24T23:36:15.739Z", "datePublished": "2026-10-08T22:53:59.530Z", "dateUpdated": "2026-10-09T16:32:57.198Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-10-08T22:53:59.530Z"}, "title": "Excessive CPU consumption from repeated initial window changes in net/http", "descriptions": [{"lang": "en", "value": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}], "affected": [{"vendor": "Go standard library", "product": "net/http", "collectionURL": "https://pkg.go.dev", "packageName": "net/http", "versions": [{"version": "0", "lessThan": "1.26.9", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "http2outflow.add"}, {"name": "http2outflow.available"}, {"name": "http2outflow.setConnFlow"}, {"name": "http2outflow.take"}, {"name": "http2Server.serveConn"}, {"name": "http2serverConn.newStream"}, {"name": "http2serverConn.processSettingInitialWindowSize"}, {"name": "http2serverConn.processWindowUpdate"}, {"name": "http2serverConn.scheduleFrameWrite"}, {"name": "http2ClientConn.addStreamLocked"}, {"name": "http2Transport.newClientConn"}, {"name": "http2clientConnReadLoop.processSettingsNoWrite"}, {"name": "http2clientConnReadLoop.processWindowUpdate"}, {"name": "http2clientConnReadLoop.streamByID"}, {"name": "http2clientStream.awaitFlowControl"}, {"name": "http2clientStream.cleanupWriteRequest"}, {"name": "http2FrameWriteRequest.Consume"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC7540.Pop"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.Pop"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2randomWriteScheduler.Pop"}, {"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2roundRobinWriteScheduler.Pop"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "defaultStatus": "unaffected"}, {"vendor": "Go standard library", "product": "net/http/internal/http2", "collectionURL": "https://pkg.go.dev", "packageName": "net/http/internal/http2", "versions": [{"version": "1.27.0-0", "lessThan": "1.27.2", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "outflow.add"}, {"name": "outflow.available"}, {"name": "outflow.setConnFlow"}, {"name": "outflow.take"}, {"name": "Server.serveConn"}, {"name": "serverConn.newStream"}, {"name": "serverConn.processSettingInitialWindowSize"}, {"name": "serverConn.processWindowUpdate"}, {"name": "serverConn.scheduleFrameWrite"}, {"name": "ClientConn.addStreamLocked"}, {"name": "Transport.newClientConn"}, {"name": "clientConnReadLoop.processSettingsNoWrite"}, {"name": "clientConnReadLoop.processWindowUpdate"}, {"name": "clientConnReadLoop.streamByID"}, {"name": "clientStream.awaitFlowControl"}, {"name": "clientStream.cleanupWriteRequest"}, {"name": "FrameWriteRequest.Consume"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "NetHTTPClientConn.Close"}, {"name": "NetHTTPClientConn.Ping"}, {"name": "NetHTTPClientConn.RoundTrip"}, {"name": "ReadFrameHeader"}, {"name": "Server.GracefulShutdown"}, {"name": "Server.ServeConn"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "Transport.AddConn"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "priorityWriteSchedulerRFC9218.Pop"}, {"name": "requestBody.Close"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.Pop"}, {"name": "serve400Handler.ServeHTTP"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}], "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/net", "product": "golang.org/x/net/http2", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/net/http2", "versions": [{"version": "0", "lessThan": "0.60.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "outflow.add"}, {"name": "outflow.available"}, {"name": "outflow.setConnFlow"}, {"name": "outflow.take"}, {"name": "Server.serveConn"}, {"name": "serverConn.newStream"}, {"name": "serverConn.processSettingInitialWindowSize"}, {"name": "serverConn.processWindowUpdate"}, {"name": "serverConn.scheduleFrameWrite"}, {"name": "ClientConn.addStreamLocked"}, {"name": "Transport.newClientConn"}, {"name": "clientConnReadLoop.processSettingsNoWrite"}, {"name": "clientConnReadLoop.processWindowUpdate"}, {"name": "clientConnReadLoop.streamByID"}, {"name": "clientStream.awaitFlowControl"}, {"name": "clientStream.cleanupWriteRequest"}, {"name": "FrameWriteRequest.Consume"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC7540.Pop"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.Pop"}, {"name": "pseudoHeaderError.Error"}, {"name": "randomWriteScheduler.Pop"}, {"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "roundRobinWriteScheduler.Pop"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-405: Asymmetric Resource Consumption (Amplification)"}]}], "references": [{"url": "https://go.dev/cl/847186"}, {"url": "https://go.dev/cl/847308"}, {"url": "https://go.dev/issue/81742"}, {"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6611"}], "credits": [{"lang": "en", "value": "Jakub Ciolek (https://ciolek.dev)"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-405", "lang": "en", "description": "CWE-405 Asymmetric Resource Consumption (Amplification)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T16:32:53.872432Z", "id": "CVE-2026-78669", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T16:32:57.198Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-78669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T16:32:53.872432Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-405", "description": "CWE-405 Asymmetric Resource Consumption (Amplification)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T16:31:11.090Z"}}], "cna": {"title": "Excessive CPU consumption from repeated initial window changes in net/http", "credits": [{"lang": "en", "value": "Jakub Ciolek (https://ciolek.dev)"}], "affected": [{"vendor": "Go standard library", "product": "net/http", "versions": [{"status": "affected", "version": "0", "lessThan": "1.26.9", "versionType": "semver"}], "packageName": "net/http", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "http2outflow.add"}, {"name": "http2outflow.available"}, {"name": "http2outflow.setConnFlow"}, {"name": "http2outflow.take"}, {"name": "http2Server.serveConn"}, {"name": "http2serverConn.newStream"}, {"name": "http2serverConn.processSettingInitialWindowSize"}, {"name": "http2serverConn.processWindowUpdate"}, {"name": "http2serverConn.scheduleFrameWrite"}, {"name": "http2ClientConn.addStreamLocked"}, {"name": "http2Transport.newClientConn"}, {"name": "http2clientConnReadLoop.processSettingsNoWrite"}, {"name": "http2clientConnReadLoop.processWindowUpdate"}, {"name": "http2clientConnReadLoop.streamByID"}, {"name": "http2clientStream.awaitFlowControl"}, {"name": "http2clientStream.cleanupWriteRequest"}, {"name": "http2FrameWriteRequest.Consume"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC7540.Pop"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.Pop"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2randomWriteScheduler.Pop"}, {"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2roundRobinWriteScheduler.Pop"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}]}, {"vendor": "Go standard library", "product": "net/http/internal/http2", "versions": [{"status": "affected", "version": "1.27.0-0", "lessThan": "1.27.2", "versionType": "semver"}], "packageName": "net/http/internal/http2", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "outflow.add"}, {"name": "outflow.available"}, {"name": "outflow.setConnFlow"}, {"name": "outflow.take"}, {"name": "Server.serveConn"}, {"name": "serverConn.newStream"}, {"name": "serverConn.processSettingInitialWindowSize"}, {"name": "serverConn.processWindowUpdate"}, {"name": "serverConn.scheduleFrameWrite"}, {"name": "ClientConn.addStreamLocked"}, {"name": "Transport.newClientConn"}, {"name": "clientConnReadLoop.processSettingsNoWrite"}, {"name": "clientConnReadLoop.processWindowUpdate"}, {"name": "clientConnReadLoop.streamByID"}, {"name": "clientStream.awaitFlowControl"}, {"name": "clientStream.cleanupWriteRequest"}, {"name": "FrameWriteRequest.Consume"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "NetHTTPClientConn.Close"}, {"name": "NetHTTPClientConn.Ping"}, {"name": "NetHTTPClientConn.RoundTrip"}, {"name": "ReadFrameHeader"}, {"name": "Server.GracefulShutdown"}, {"name": "Server.ServeConn"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "Transport.AddConn"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "priorityWriteSchedulerRFC9218.Pop"}, {"name": "requestBody.Close"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.Pop"}, {"name": "serve400Handler.ServeHTTP"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}]}, {"vendor": "golang.org/x/net", "product": "golang.org/x/net/http2", "versions": [{"status": "affected", "version": "0", "lessThan": "0.60.0", "versionType": "semver"}], "packageName": "golang.org/x/net/http2", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "outflow.add"}, {"name": "outflow.available"}, {"name": "outflow.setConnFlow"}, {"name": "outflow.take"}, {"name": "Server.serveConn"}, {"name": "serverConn.newStream"}, {"name": "serverConn.processSettingInitialWindowSize"}, {"name": "serverConn.processWindowUpdate"}, {"name": "serverConn.scheduleFrameWrite"}, {"name": "ClientConn.addStreamLocked"}, {"name": "Transport.newClientConn"}, {"name": "clientConnReadLoop.processSettingsNoWrite"}, {"name": "clientConnReadLoop.processWindowUpdate"}, {"name": "clientConnReadLoop.streamByID"}, {"name": "clientStream.awaitFlowControl"}, {"name": "clientStream.cleanupWriteRequest"}, {"name": "FrameWriteRequest.Consume"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC7540.Pop"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.Pop"}, {"name": "pseudoHeaderError.Error"}, {"name": "randomWriteScheduler.Pop"}, {"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "roundRobinWriteScheduler.Pop"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}]}], "references": [{"url": "https://go.dev/cl/847186"}, {"url": "https://go.dev/cl/847308"}, {"url": "https://go.dev/issue/81742"}, {"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6611"}], "descriptions": [{"lang": "en", "value": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-405: Asymmetric Resource Consumption (Amplification)"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-10-08T22:53:59.530Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78669", "state": "PUBLISHED", "dateUpdated": "2026-10-09T16:32:57.198Z", "dateReserved": "2026-08-24T23:36:15.739Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-10-08T22:53:59.530Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "net/http", "product": "net/http", "programRoutines": [{"name": "http2outflow.add"}, {"name": "http2outflow.available"}, {"name": "http2outflow.setConnFlow"}, {"name": "http2outflow.take"}, {"name": "http2Server.serveConn"}, {"name": "http2serverConn.newStream"}, {"name": "http2serverConn.processSettingInitialWindowSize"}, {"name": "http2serverConn.processWindowUpdate"}, {"name": "http2serverConn.scheduleFrameWrite"}, {"name": "http2ClientConn.addStreamLocked"}, {"name": "http2Transport.newClientConn"}, {"name": "http2clientConnReadLoop.processSettingsNoWrite"}, {"name": "http2clientConnReadLoop.processWindowUpdate"}, {"name": "http2clientConnReadLoop.streamByID"}, {"name": "http2clientStream.awaitFlowControl"}, {"name": "http2clientStream.cleanupWriteRequest"}, {"name": "http2FrameWriteRequest.Consume"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC7540.Pop"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.Pop"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2randomWriteScheduler.Pop"}, {"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2roundRobinWriteScheduler.Pop"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.26.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "net/http/internal/http2", "product": "net/http/internal/http2", "programRoutines": [{"name": "outflow.add"}, {"name": "outflow.available"}, {"name": "outflow.setConnFlow"}, {"name": "outflow.take"}, {"name": "Server.serveConn"}, {"name": "serverConn.newStream"}, {"name": "serverConn.processSettingInitialWindowSize"}, {"name": "serverConn.processWindowUpdate"}, {"name": "serverConn.scheduleFrameWrite"}, {"name": "ClientConn.addStreamLocked"}, {"name": "Transport.newClientConn"}, {"name": "clientConnReadLoop.processSettingsNoWrite"}, {"name": "clientConnReadLoop.processWindowUpdate"}, {"name": "clientConnReadLoop.streamByID"}, {"name": "clientStream.awaitFlowControl"}, {"name": "clientStream.cleanupWriteRequest"}, {"name": "FrameWriteRequest.Consume"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "NetHTTPClientConn.Close"}, {"name": "NetHTTPClientConn.Ping"}, {"name": "NetHTTPClientConn.RoundTrip"}, {"name": "ReadFrameHeader"}, {"name": "Server.GracefulShutdown"}, {"name": "Server.ServeConn"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "Transport.AddConn"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "priorityWriteSchedulerRFC9218.Pop"}, {"name": "requestBody.Close"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.Pop"}, {"name": "serve400Handler.ServeHTTP"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.27.2", "status": "affected", "version": "1.27.0-0", "versionType": "semver"}]}, {"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/net/http2", "product": "golang.org/x/net/http2", "programRoutines": [{"name": "outflow.add"}, {"name": "outflow.available"}, {"name": "outflow.setConnFlow"}, {"name": "outflow.take"}, {"name": "Server.serveConn"}, {"name": "serverConn.newStream"}, {"name": "serverConn.processSettingInitialWindowSize"}, {"name": "serverConn.processWindowUpdate"}, {"name": "serverConn.scheduleFrameWrite"}, {"name": "ClientConn.addStreamLocked"}, {"name": "Transport.newClientConn"}, {"name": "clientConnReadLoop.processSettingsNoWrite"}, {"name": "clientConnReadLoop.processWindowUpdate"}, {"name": "clientConnReadLoop.streamByID"}, {"name": "clientStream.awaitFlowControl"}, {"name": "clientStream.cleanupWriteRequest"}, {"name": "FrameWriteRequest.Consume"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC7540.Pop"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.Pop"}, {"name": "pseudoHeaderError.Error"}, {"name": "randomWriteScheduler.Pop"}, {"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "roundRobinWriteScheduler.Pop"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "vendor": "golang.org/x/net", "versions": [{"lessThan": "0.60.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}], "id": "CVE-2026-78669", "lastModified": "2026-10-09T17:16:49.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78669", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T16:32:53.872432Z", "version": "2.0.3"}}]}, "published": "2026-10-08T23:17:04.010", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/847186"}, {"source": "security@golang.org", "url": "https://go.dev/cl/847308"}, {"source": "security@golang.org", "url": "https://go.dev/issue/81742"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-6611"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-405"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "id": "2548344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive."], "mitigation": {"lang": "en:us", "value": "In case you consume HTTP2, upgrade to a patched version of the http module.\nVerify:\n```\ngo version\ngo list -m golang.org/x/net\ngovulncheck ./...\n```"}, "name": "CVE-2026-78669", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "helm", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines-client", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "kn-workflow-plugin", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-clients", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Affected", "package_name": "istio-proxy", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Affected", "impact": "important", "package_name": "openshift-golang-builder-container", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "automation-gateway-proxy", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "automation-gateway-proxy-openssl30", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "automation-gateway-proxy-openssl32", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "receptor", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Affected", "package_name": "libarrow", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:certifications:9", "fix_state": "Affected", "package_name": "redhat-certification-cnf", "product_name": "Red Hat Certification Program for Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:certifications:9", "fix_state": "Affected", "package_name": "redhat-certification-preflight", "product_name": "Red Hat Certification Program for Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "flightctl", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "butane", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "conmon", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "delve", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "git-lfs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "go-fdo-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "go-fdo-server", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "golang", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "golang-github-openprinting-ipp-usb", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "grafana-pcp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "gvisor-tap-vsock", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ignition", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "image-builder", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "oci-delta", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "oci-seccomp-bpf-hook", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "opentelemetry-collector", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "osbuild-composer", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhc-worker-playbook", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "skopeo", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "toolbox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "weldr-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "yggdrasil", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "compat-sap-c++-11", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "host-metering", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "rhc-worker-script", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "compat-sap-c++-11", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/conmon", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/containernetworking-plugins", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/crun", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/oci-seccomp-bpf-hook", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/runc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/skopeo", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/toolbox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "git-lfs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "go-toolset:rhel8/golang", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana-pcp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "osbuild-composer", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "weldr-client", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "butane", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "conmon", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "containernetworking-plugins", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "delve", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "git-lfs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "golang", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana-pcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "gvisor-tap-vsock", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ignition", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "image-builder", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "oci-delta", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "oci-seccomp-bpf-hook", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "opentelemetry-collector", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "osbuild-composer", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "skopeo", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "toolbox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "weldr-client", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "golang", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "butane", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "conmon", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "conmon-rs", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "containernetworking-plugins", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "cri-o", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "cri-tools", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "golang-github-prometheus-promu", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "ignition", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "kata-containers", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "microshift", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift-clients", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "important", "package_name": "openshift-golang-builder-container", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift-kuryr", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "ose-aws-ecr-image-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "ose-azure-acr-image-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "ose-crio-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "ose-gcp-gcr-image-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "skopeo", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "toolbox", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_service_on_aws:1", "fix_state": "Affected", "package_name": "rosa", "product_name": "Red Hat OpenShift on AWS"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "impact": "important", "package_name": "openshift-golang-builder-container", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "golang-github-infrawatch-apputils", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "golang-github-Sirupsen-logrus", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "collectd-libpod-stats", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "golang-github-infrawatch-apputils", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "golang-github-Sirupsen-logrus", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "golang-uber-atomic", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "golang-uber-multierr", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "golang-github-openstack-k8s-operators-os-diff", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "yggdrasil-worker-forwarder", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:service_interconnect:1", "fix_state": "Affected", "package_name": "skupper-cli", "product_name": "Red Hat Service Interconnect 1"}, {"cpe": "cpe:/a:redhat:service_interconnect:2", "fix_state": "Affected", "package_name": "skupper-cli", "product_name": "Red Hat Service Interconnect 2"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "golang-github-danielqsj-kafka_exporter", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "golang-github-danielqsj-kafka_exporter", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-10-08T22:53:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-78669\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-78669\nhttps://go.dev/cl/847186\nhttps://go.dev/cl/847308\nhttps://go.dev/issue/81742\nhttps://groups.google.com/g/golang-announce/c/U2fTuyDJznI\nhttps://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs\nhttps://pkg.go.dev/vuln/GO-2026-6611"], "statement": "A flaw was found in the Go net/http package and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of HTTP/2 streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Each SETTINGS frame forces the server or client to iterate over all open streams to adjust their flow-control windows, resulting in quadratic CPU usage and denial of service.\nThis vulnerability affects all Go programs that serve or consume HTTP/2 traffic using net/http or golang.org/x/net/http2.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.26.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "net/http", "source": "cna", "vendor": "Go standard library"}, "product": "net/http", "vendor": "go_standard_library"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.27.0-0,1.27.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "net/http/internal/http2", "source": "cna", "vendor": "Go standard library"}, "product": "net/http", "vendor": "go_standard_library"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.60.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/net/http2", "source": "cna", "vendor": "golang.org/x/net"}, "product": "net/http2", "vendor": "go_standard_library"}], "created": "2026-10-09T00:30:17.782701+00:00", "updated": "2026-10-09T19:15:12.225816+00:00", "vendors": ["go_standard_library", "go_standard_library$PRODUCT$net/http", "go_standard_library$PRODUCT$net/http2"]}