Vulnerability Report: GO-2026-6603
- CVE-2026-78659
- Affects: net/http, net/http/internal/http2, and 1 more
- Published: Oct 08, 2026
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
Affected Packages
-
PathVersionsSymbols
-
before go1.26.9
87 affected symbols
- CanonicalHeaderKey
- Client.CloseIdleConnections
- Client.Do
- Client.Get
- Client.Head
- Client.Post
- Client.PostForm
- ClientConn.Close
- ClientConn.RoundTrip
- Cookie.String
- Cookie.Valid
- CrossOriginProtection.AddInsecureBypassPattern
- CrossOriginProtection.AddTrustedOrigin
- CrossOriginProtection.Check
- Dir.Open
- Error
- Get
- Handle
- HandleFunc
- HandlerFunc.ServeHTTP
- Head
- Header.Add
- Header.Del
- Header.Get
- Header.Set
- Header.Values
- Header.Write
- Header.WriteSubset
- ListenAndServe
- ListenAndServeTLS
- NewRequest
- NewRequestWithContext
- NotFound
- ParseCookie
- ParseSetCookie
- ParseTime
- Post
- PostForm
- ProxyFromEnvironment
- ReadRequest
- ReadResponse
- Redirect
- Request.AddCookie
- Request.BasicAuth
- Request.Cookie
- Request.Cookies
- Request.CookiesNamed
- Request.FormFile
- Request.FormValue
- Request.MultipartReader
- Request.ParseForm
- Request.ParseMultipartForm
- Request.PostFormValue
- Request.Referer
- Request.SetBasicAuth
- Request.UserAgent
- Request.Write
- Request.WriteProxy
- Response.Cookies
- Response.Location
- Response.Write
- ResponseController.EnableFullDuplex
- ResponseController.Flush
- ResponseController.Hijack
- ResponseController.SetReadDeadline
- ResponseController.SetWriteDeadline
- Serve
- ServeContent
- ServeFile
- ServeFileFS
- ServeMux.Handle
- ServeMux.HandleFunc
- ServeMux.ServeHTTP
- ServeTLS
- Server.Close
- Server.ListenAndServe
- Server.ListenAndServeTLS
- Server.Serve
- Server.ServeTLS
- Server.SetKeepAlivesEnabled
- Server.Shutdown
- SetCookie
- Transport.CancelRequest
- Transport.Clone
- Transport.CloseIdleConnections
- Transport.NewClientConn
- Transport.RoundTrip
-
from go1.27.0-0 before go1.27.2
33 affected symbols
- ClientConn.Close
- ClientConn.Ping
- ClientConn.RoundTrip
- ClientConn.Shutdown
- Framer.ReadFrame
- Framer.ReadFrameForHeader
- Framer.ReadFrameHeader
- Framer.WriteContinuation
- Framer.WriteData
- Framer.WriteDataPadded
- Framer.WriteGoAway
- Framer.WriteHeaders
- Framer.WritePing
- Framer.WritePriority
- Framer.WritePriorityUpdate
- Framer.WritePushPromise
- Framer.WriteRSTStream
- Framer.WriteRawFrame
- Framer.WriteSettings
- Framer.WriteSettingsAck
- Framer.WriteWindowUpdate
- NetHTTPClientConn.Close
- NetHTTPClientConn.Ping
- NetHTTPClientConn.RoundTrip
- ReadFrameHeader
- Server.GracefulShutdown
- Server.ServeConn
- SettingsFrame.ForeachSetting
- Transport.AddConn
- Transport.CloseIdleConnections
- Transport.NewClientConn
- Transport.RoundTrip
- Transport.RoundTripOpt
-
before v0.60.0
40 affected symbols
- ClientConn.Close
- ClientConn.Ping
- ClientConn.RoundTrip
- ClientConn.Shutdown
- ConfigureServer
- ConfigureTransport
- ConfigureTransports
- ConnectionError.Error
- ErrCode.String
- FrameHeader.String
- FrameType.String
- FrameWriteRequest.String
- Framer.ReadFrame
- Framer.ReadFrameForHeader
- Framer.ReadFrameHeader
- Framer.WriteContinuation
- Framer.WriteData
- Framer.WriteDataPadded
- Framer.WriteGoAway
- Framer.WriteHeaders
- Framer.WritePing
- Framer.WritePriority
- Framer.WritePriorityUpdate
- Framer.WritePushPromise
- Framer.WriteRSTStream
- Framer.WriteRawFrame
- Framer.WriteSettings
- Framer.WriteSettingsAck
- Framer.WriteWindowUpdate
- GoAwayError.Error
- ReadFrameHeader
- Server.ServeConn
- Setting.String
- SettingID.String
- SettingsFrame.ForeachSetting
- StreamError.Error
- Transport.CloseIdleConnections
- Transport.NewClientConn
- Transport.RoundTrip
- Transport.RoundTripOpt
Aliases
References
- https://go.dev/cl/847185
- https://go.dev/cl/847314
- https://go.dev/issue/81857
- https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
- https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs
- https://vuln.go.dev/ID/GO-2026-6603.json
Credits
- RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
Feedback
See anything missing or incorrect?
Suggest an edit to this report.