What’s Vulnerable › Products

golang.org/x/net/http2 vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your golang.org/x/net/http2 version is affected

Latest golang.org/x/net/http2 vulnerabilities

• CVE-2026-97032 — HTTP/2 server crash due to HPACK encoder race in net/http (CVSS 7.5)
• CVE-2026-78669 — Excessive CPU consumption from repeated initial window changes in net/http (CVSS 7.5)
• CVE-2026-78663 — Double flow control refund on HTTP/2 server streams in net/http (CVSS 9.1)
• CVE-2026-78660 — HTTP/2 transport accepts malformed framing-related headers in net/http (CVSS 7.5)
• CVE-2026-78659 — HTTP/2 server memory exhaustion due to Trailer headers in net/http (CVSS 7.5)
• CVE-2026-27141 — Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net (CVSS 7.5)