CVE-2026-78663: Double flow control refund on HTTP/2 server streams in net/http

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-09
Weakness: CWE-675

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Affected products

Golang.Org/X/Net: before 0.60.0 — fixed in 0.60.0
Go Stdlib: before 1.26.9; from 1.27.0-0 before 1.27.2 — fixed in 1.26.9, 1.27.2
golang.org/x/net/http2: before 0.60.0 — fixed in 0.60.0
Go standard library net/http: before 1.26.9 — fixed in 1.26.9
Go standard library net/http/internal/http2: from 1.27.0-0 before 1.27.2 — fixed in 1.27.2

How to fix

Upgrade to a fixed version: Golang.Org/X/Net 0.60.0; Go Stdlib 1.26.9, 1.27.2; golang.org/x/net/http2 0.60.0; Go standard library net/http 1.26.9; Go standard library net/http/internal/http2 1.27.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-78663 or the next vulnerability affects your stack