{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78663", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-08-24T23:36:15.738Z", "datePublished": "2026-10-08T22:53:59.772Z", "dateUpdated": "2026-10-08T22:53:59.772Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-10-08T22:53:59.772Z"}, "title": "Double flow control refund on HTTP/2 server streams in net/http", "descriptions": [{"lang": "en", "value": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}], "affected": [{"vendor": "Go standard library", "product": "net/http", "collectionURL": "https://pkg.go.dev", "packageName": "net/http", "versions": [{"version": "0", "lessThan": "1.26.9", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2serverConn.closeStream"}, {"name": "http2serverConn.handlerDone"}, {"name": "http2serverConn.newWriterAndRequest"}, {"name": "http2serverConn.newWriterAndRequestNoBody"}, {"name": "http2serverConn.noteBodyRead"}, {"name": "http2serverConn.processHeaders"}, {"name": "http2serverConn.runHandler"}, {"name": "http2serverConn.scheduleHandler"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "defaultStatus": "unaffected"}, {"vendor": "Go standard library", "product": "net/http/internal/http2", "collectionURL": "https://pkg.go.dev", "packageName": "net/http/internal/http2", "versions": [{"version": "1.27.0-0", "lessThan": "1.27.2", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "serverConn.closeStream"}, {"name": "serverConn.handlerDone"}, {"name": "serverConn.newWriterAndRequest"}, {"name": "serverConn.newWriterAndRequestNoBody"}, {"name": "serverConn.noteBodyRead"}, {"name": "serverConn.processHeaders"}, {"name": "serverConn.runHandler"}, {"name": "serverConn.scheduleHandler"}, {"name": "Server.ServeConn"}], "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/net", "product": "golang.org/x/net/http2", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/net/http2", "versions": [{"version": "0", "lessThan": "0.60.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "serverConn.closeStream"}, {"name": "serverConn.handlerDone"}, {"name": "serverConn.newWriterAndRequest"}, {"name": "serverConn.newWriterAndRequestNoBody"}, {"name": "serverConn.noteBodyRead"}, {"name": "serverConn.processHeaders"}, {"name": "serverConn.runHandler"}, {"name": "serverConn.scheduleHandler"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "pseudoHeaderError.Error"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-675: Multiple Operations on Resource in Single-Operation Context"}]}], "references": [{"url": "https://go.dev/cl/847187"}, {"url": "https://go.dev/cl/847310"}, {"url": "https://go.dev/issue/81743"}, {"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6612"}], "credits": [{"lang": "en", "value": "Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)"}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "net/http", "product": "net/http", "programRoutines": [{"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2serverConn.closeStream"}, {"name": "http2serverConn.handlerDone"}, {"name": "http2serverConn.newWriterAndRequest"}, {"name": "http2serverConn.newWriterAndRequestNoBody"}, {"name": "http2serverConn.noteBodyRead"}, {"name": "http2serverConn.processHeaders"}, {"name": "http2serverConn.runHandler"}, {"name": "http2serverConn.scheduleHandler"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.26.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "net/http/internal/http2", "product": "net/http/internal/http2", "programRoutines": [{"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "serverConn.closeStream"}, {"name": "serverConn.handlerDone"}, {"name": "serverConn.newWriterAndRequest"}, {"name": "serverConn.newWriterAndRequestNoBody"}, {"name": "serverConn.noteBodyRead"}, {"name": "serverConn.processHeaders"}, {"name": "serverConn.runHandler"}, {"name": "serverConn.scheduleHandler"}, {"name": "Server.ServeConn"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.27.2", "status": "affected", "version": "1.27.0-0", "versionType": "semver"}]}, {"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/net/http2", "product": "golang.org/x/net/http2", "programRoutines": [{"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "serverConn.closeStream"}, {"name": "serverConn.handlerDone"}, {"name": "serverConn.newWriterAndRequest"}, {"name": "serverConn.newWriterAndRequestNoBody"}, {"name": "serverConn.noteBodyRead"}, {"name": "serverConn.processHeaders"}, {"name": "serverConn.runHandler"}, {"name": "serverConn.scheduleHandler"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "pseudoHeaderError.Error"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "vendor": "golang.org/x/net", "versions": [{"lessThan": "0.60.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}], "id": "CVE-2026-78663", "lastModified": "2026-10-08T23:17:03.647", "metrics": {}, "published": "2026-10-08T23:17:03.647", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/847187"}, {"source": "security@golang.org", "url": "https://go.dev/cl/847310"}, {"source": "security@golang.org", "url": "https://go.dev/issue/81743"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-6612"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Received"}

{}

{"created": "2026-10-09T01:30:18.085868+00:00", "updated": "2026-10-09T01:30:18.086192+00:00", "vendors": [], "weaknesses": ["CWE-399"]}