What’s Vulnerable › Products
Go standard library net/http vulnerabilities
15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your Go standard library net/http version is affected
Latest Go standard library net/http vulnerabilities
- CVE-2026-97032 — HTTP/2 server crash due to HPACK encoder race in net/http (CVSS 7.5)
- CVE-2026-94439 — HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http (CVSS 7.5)
- CVE-2026-78669 — Excessive CPU consumption from repeated initial window changes in net/http (CVSS 7.5)
- CVE-2026-78667 — Lack of limit on size of parsed Range headers in net/http (CVSS 7.5)
- CVE-2026-78663 — Double flow control refund on HTTP/2 server streams in net/http (CVSS 9.1)
- CVE-2026-78660 — HTTP/2 transport accepts malformed framing-related headers in net/http (CVSS 7.5)
- CVE-2026-78659 — HTTP/2 server memory exhaustion due to Trailer headers in net/http (CVSS 7.5)
- CVE-2026-56866 — HTTP/1 client connection desynchronization after CONNECT rejection in net/http (CVSS 7.5)
- CVE-2026-56853 — Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http (CVSS 7.5)
- CVE-2025-58186 — Lack of limit when parsing cookies can cause memory exhaustion in net/http (CVSS 5.3)
- CVE-2025-47910 — CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http (CVSS 5.4)
- CVE-2025-4673 — Sensitive headers not cleared on cross-origin redirect in net/http (CVSS 6.8)
- CVE-2025-22870 — HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (CVSS 4.4)
- CVE-2024-45336 — Sensitive headers incorrectly sent after cross-domain redirect in net/http (CVSS 6.1)
- CVE-2023-45289 — Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http (CVSS 4.3)