Go net/http
CVE-2026-78659
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen HTTP/2 connection to server
-
DeliverySend request with oversized Trailer header
-
ExploitServer allocates large Request.Trailer map
-
ExecutionRepeat across multiplexed streams
-
ImpactMemory exhaustion and denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Asymmetric resource consumption control
|
| Exploitation Conditions | The target must be an HTTP/2-enabled Go net/http server (HTTP/2 is negotiated by default over TLS in Go's standard library); the description explicitly states HTTP/1 servers are NOT affected because they do not multiplex many requests over one TCP connection and compute MaxHeaderBytes differently. No authentication is required (PR:N) and no user interaction is needed (UI:N) - the attacker simply sends a crafted 'Trailer' header declaring many fields. The key limiting factor is that configured defenses (Server.MaxHeaderValueCount, Server.MaxHeaderBytes) do NOT mitigate this because trailer population bypasses them; the only effective limit is serving HTTP/1-only or applying the vendor patch. |
| Impact | This is a genuine but moderate-priority availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) correctly reflects a remote, unauthenticated, low-complexity denial-of-service against availability only - there is no confidentiality or integrity impact (CWE-405, asymmetric/uncontrolled resource consumption). The real-world exploitation signals are consistently low-to-moderate and align with each other rather than conflicting: EPSS is only 0.23% (12th percentile), CISA SSVC lists Exploitation as 'none' (no observed exploitation and no public exploit identified at time of analysis), and the KEV catalog does not list it. SSVC does flag Automatable: yes and Technical Impact: partial, which fits a scriptable memory-amplification DoS that degrades rather than fully compromises a target. The patch availability from the Go project is the dominant actionable signal. One notable data-quality conflict: the input Tags label this 'Authentication Bypass', which flatly contradicts the description, the CVSS vector (C:N/I:N), and CWE-405 - this is a memory-exhaustion DoS, not an auth bypass, and the tag should be treated as mislabeled. Net: patch during normal maintenance cycles for internet-facing Go HTTP/2 services; it is a real resource-exhaustion flaw but currently shows no evidence of active or widespread exploitation. |
| Exploit ScenarioDerived | A malicious client opens an HTTP/2 connection to a Go-based web server and sends requests whose 'Trailer' header declares a very large number of trailer field names. The server populates a per-request Request.Trailer map for each declared field, bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits and allocating disproportionate memory until the service degrades or exhausts memory. No public exploit code is identified at time of analysis, but the technique is simple and SSVC rates it automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 09, 2026
Memory exhaustion in Go's standard-library net/http HTTP/2 server lets a remote attacker send a single crafted request whose "Trailer" header declares an excessive number of fields, causing the server to allocate a disproportionately large Request.Trailer map for the handler. The issue is availability-only (C:N/I:N/A:H), requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and crucially bypasses the Server.MaxHeaderValueCount and Server.MaxHeaderBytes defenses; HTTP/1 servers are not affected because they do not multiplex many requests over one connection and account for MaxHeaderBytes differently. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.23% (12th percentile), and vendor patches are available, so this is a genuine but moderate-priority availability bug rather than an emergency.
Earlier versions of this analysis (1)
Unauthenticated remote clients can exhaust memory on Go HTTP/2 servers implemented via golang.org/x/net and the bundled standard-library net/http by sending a 'Trailer' header that declares an extremely large number of trailer fields. Because each declared field is materialized as an entry in the Request.Trailer map passed to the application handler, the server allocates disproportionate memory, and the declared trailers bypass the Server.MaxHeaderValueCount and Server.MaxHeaderBytes protections that normally cap header consumption. The flaw is availability-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), affects only HTTP/2 listeners - HTTP/1 servers do not multiplex enough requests over one connection and compute MaxHeaderBytes differently, so they are explicitly not exploitable - and there is no public exploit code and no confirmed in-the-wild exploitation identified at time of analysis. Upstream fixes are merged and tracking under Go issue 81857 (milestone Go1.28), leaving unpatched HTTP/2-exposed Go services at risk of memory exhaustion and denial of service.
RemediationAI
Vendor-released patch: apply the Go standard-library fix published with advisory GO-2026-6603, which is referenced through the Go security release announcements at https://groups.google.com/g/golang-announce/c/U2fTuyDJznI and https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs and the upstream changelists https://go.dev/cl/847185 and https://go.dev/cl/847314; rebuild and redeploy your services with the patched toolchain, since Go vulnerabilities are fixed by recompiling rather than by swapping a runtime library (the provided data does not specify an exact patched version number, so confirm the fixed release on the advisory page before upgrading). Until rebuilds are complete, the effective compensating control is to stop serving HTTP/2: either terminate HTTP/2 at a reverse proxy that enforces its own hard limit on declared trailer fields, or, within the Go process, disable automatic HTTP/2 negotiation (for example by setting a non-nil, empty TLSNextProto map so the server does not upgrade connections) or run the listener as HTTP/1-only - the trade-off is the loss of HTTP/2 multiplexing, header compression and related performance benefits, and any clients that require HTTP/2 will fall back or fail. Do not rely on lowering or raising Server.MaxHeaderValueCount or Server.MaxHeaderBytes as a mitigation: per the vendor and the independent assessment, the trailer-population path bypasses both limits and tuning them provides only false assurance. Because the issue is an unauthenticated, automatable amplification (CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial), also apply per-connection request and memory/GC limits and monitor for abnormal trailer counts or connection-level memory growth as a detection and blast-radius control, while noting that such limits can throttle legitimate high-throughput HTTP/2 traffic.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Go's net/http server implementation when HTTP/2 is in use; HTTP/2 is negotiated by default over TLS in the standard library, and is also exposed by any Go service that enables the h2 handler. Under HTTP/2, trailers are delivered as a trailing HEADERS frame (or as part of the request's header block) and the server materialises the declared trailer fields into the map handed to the handler as Request.Trailer. Because that structure is a map, every declared field costs per-entry overhead, and the trailer-population path in this version does not apply the accounting that normally constrains request headers, so neither Server.MaxHeaderValueCount nor Server.MaxHeaderBytes caps the resulting allocation. The root cause class is CWE-405 (Asymmetric Resource Consumption / Amplification): a small, cheap request produces a large server-side allocation, and HTTP/2's stream multiplexing lets an attacker repeat the pattern cheaply across many concurrent streams on a single TCP connection. HTTP/1 is explicitly out of scope because it cannot multiplex large numbers of requests over one connection and its MaxHeaderBytes accounting is computed differently. No CPE strings were supplied in the source data, and the reference set points to Go's own advisory identifier GO-2026-6603 along with upstream issue and changelist references (go.dev/issue/81857, go.dev/issue/81833, go.dev/issue/81823, go.dev/cl/847185, go.dev/cl/847314). One caveat on the supplied metadata: the attached tag "Authentication Bypass" is inconsistent with both the description and the independently assessed vector - this is an unauthenticated availability (denial-of-service) issue, not an access-control bypass, and no confidentiality or integrity impact is assessed (C:N/I:N).
Know when Go gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated client sends a crafted Trailer header (AV:N/AC:L/PR:N/UI:N) causing memory exhaustion; impact is availability only (A:H, C:N/I:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Technical POC Analysis
Evidence caveat up front: the supplied source (a solve.mjs / PR #3002 log gist) contains no patch diff, no PoC, and no net/http code.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A memory-exhaustion flaw in Go's standard-library net/http HTTP/2 server (CVE-2026-78659, CVSS 7.5) allows any unauthenticated remote client to force a disproportionately large memory allocation with a single crafted request, bypassing the server's header-limit safeguards and potentially degrading or crashing Go-based services. Organizations running Go HTTP/2 endpoints, including APIs, microservices, and internal platforms, face avoidable availability disruption until remediated. No public exploit identified at time of analysis, but the low attack complexity and broad deployment footprint of Go-based services make prompt patching the right risk-management decision.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Exploit-DB