CVE-2026-97032: HTTP/2 server crash due to HPACK encoder race in net/http

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-15
Weakness: CWE-362

Description

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Affected products

Golang.Org/X/Net: before 0.60.0 — fixed in 0.60.0
Go Stdlib: before 1.26.9; from 1.27.0-0 before 1.27.2 — fixed in 1.26.9, 1.27.2
golang.org/x/net/http2: before 0.60.0 — fixed in 0.60.0
Go standard library net/http: before 1.26.9 — fixed in 1.26.9
Go standard library net/http/internal/http2: from 1.27.0-0 before 1.27.2 — fixed in 1.27.2

How to fix

Upgrade to a fixed version: Golang.Org/X/Net 0.60.0; Go Stdlib 1.26.9, 1.27.2; golang.org/x/net/http2 0.60.0; Go standard library net/http 1.26.9; Go standard library net/http/internal/http2 1.27.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-97032 or the next vulnerability affects your stack