Vulnerability Report: GO-2026-6612
- CVE-2026-78663
- Affects: net/http, net/http/internal/http2, and 1 more
- Published: Oct 08, 2026
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Affected Packages
-
PathVersionsSymbols
-
before go1.26.9
87 affected symbols
- CanonicalHeaderKey
- Client.CloseIdleConnections
- Client.Do
- Client.Get
- Client.Head
- Client.Post
- Client.PostForm
- ClientConn.Close
- ClientConn.RoundTrip
- Cookie.String
- Cookie.Valid
- CrossOriginProtection.AddInsecureBypassPattern
- CrossOriginProtection.AddTrustedOrigin
- CrossOriginProtection.Check
- Dir.Open
- Error
- Get
- Handle
- HandleFunc
- HandlerFunc.ServeHTTP
- Head
- Header.Add
- Header.Del
- Header.Get
- Header.Set
- Header.Values
- Header.Write
- Header.WriteSubset
- ListenAndServe
- ListenAndServeTLS
- NewRequest
- NewRequestWithContext
- NotFound
- ParseCookie
- ParseSetCookie
- ParseTime
- Post
- PostForm
- ProxyFromEnvironment
- ReadRequest
- ReadResponse
- Redirect
- Request.AddCookie
- Request.BasicAuth
- Request.Cookie
- Request.Cookies
- Request.CookiesNamed
- Request.FormFile
- Request.FormValue
- Request.MultipartReader
- Request.ParseForm
- Request.ParseMultipartForm
- Request.PostFormValue
- Request.Referer
- Request.SetBasicAuth
- Request.UserAgent
- Request.Write
- Request.WriteProxy
- Response.Cookies
- Response.Location
- Response.Write
- ResponseController.EnableFullDuplex
- ResponseController.Flush
- ResponseController.Hijack
- ResponseController.SetReadDeadline
- ResponseController.SetWriteDeadline
- Serve
- ServeContent
- ServeFile
- ServeFileFS
- ServeMux.Handle
- ServeMux.HandleFunc
- ServeMux.ServeHTTP
- ServeTLS
- Server.Close
- Server.ListenAndServe
- Server.ListenAndServeTLS
- Server.Serve
- Server.ServeTLS
- Server.SetKeepAlivesEnabled
- Server.Shutdown
- SetCookie
- Transport.CancelRequest
- Transport.Clone
- Transport.CloseIdleConnections
- Transport.NewClientConn
- Transport.RoundTrip
-
from go1.27.0-0 before go1.27.2
-
before v0.60.0
40 affected symbols
- ClientConn.Close
- ClientConn.Ping
- ClientConn.RoundTrip
- ClientConn.Shutdown
- ConfigureServer
- ConfigureTransport
- ConfigureTransports
- ConnectionError.Error
- ErrCode.String
- FrameHeader.String
- FrameType.String
- FrameWriteRequest.String
- Framer.ReadFrame
- Framer.ReadFrameForHeader
- Framer.ReadFrameHeader
- Framer.WriteContinuation
- Framer.WriteData
- Framer.WriteDataPadded
- Framer.WriteGoAway
- Framer.WriteHeaders
- Framer.WritePing
- Framer.WritePriority
- Framer.WritePriorityUpdate
- Framer.WritePushPromise
- Framer.WriteRSTStream
- Framer.WriteRawFrame
- Framer.WriteSettings
- Framer.WriteSettingsAck
- Framer.WriteWindowUpdate
- GoAwayError.Error
- ReadFrameHeader
- Server.ServeConn
- Setting.String
- SettingID.String
- SettingsFrame.ForeachSetting
- StreamError.Error
- Transport.CloseIdleConnections
- Transport.NewClientConn
- Transport.RoundTrip
- Transport.RoundTripOpt
Aliases
References
- https://go.dev/cl/847187
- https://go.dev/cl/847310
- https://go.dev/issue/81743
- https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
- https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs
- https://vuln.go.dev/ID/GO-2026-6612.json
Credits
- Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.