Skip to contentGo Standard Library Net/http/internal/http2 vulnerabilities
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server crash due to HPACK encoder race in net/httpCVE-2026-97032Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreExcessive CPU consumption from repeated initial window changes in net/httpCVE-2026-78669Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreDouble flow control refund on HTTP/2 server streams in net/httpCVE-2026-78663Fix available9.1 Critical
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server memory exhaustion due to Trailer headers in net/httpCVE-2026-78659Fix available7.5 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical