Go net/http CVE-2026-97032
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen HTTP/2 connection to server
-
DeliverySend request forcing HEADERS encode
-
ExploitConcurrently send SETTINGS_HEADER_TABLE_SIZE change
-
ExecutionTrigger unsynchronized HPACK encoder race
-
ImpactCrash server process (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a Go server running the HTTP/2 protocol handler (net/http with HTTP/2, which is enabled by default on Go TLS/HTTPS servers, or golang.org/x/net/http2). Exploitation requires the attacker to send a stream of requests that force the server to encode HEADERS responses while simultaneously sending SETTINGS frames altering SETTINGS_HEADER_TABLE_SIZE, so the two goroutines mutate the shared HPACK encoder concurrently. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: HTTP/2 must be in use (servers restricted to HTTP/1.1 are unaffected), and because this is a timing-dependent race, reliably crashing the process requires repeated requests to hit the unsynchronized window rather than a single deterministic payload. |
| Impact | This is an availability-only denial-of-service flaw in Go's HTTP/2 server implementation (net/http / golang.org/x/net/http2, tracked as GO-2026-6617), driven by an unsynchronized concurrent-write race on the shared HPACK encoder (CWE-362). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) marks it network-reachable and unauthenticated with no confidentiality or integrity impact. Signals are consistent but modest: EPSS is low (0.18%, 7th percentile) and it is NOT listed in CISA KEV, indicating no confirmed real-world exploitation, while publicly available exploit code does exist. The signals are therefore aligned rather than conflicting - a genuinely reachable but low-urgency DoS. One caveat: NVD rates attack complexity AC:L, yet the root cause is a timing-dependent concurrency race that a client must trigger by 'repeatedly' sending requests, which argues for AC:H; the impact is a crash (panic), not code execution. Prioritize patching on internet-facing Go HTTP/2 services, but this is a reliability/availability issue, not a high-real-risk compromise vector. |
| Exploit ScenarioDerived | A malicious client opens an HTTP/2 connection to a vulnerable Go server and repeatedly issues requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE, so the goroutine encoding a HEADERS response and the goroutine resizing the HPACK table touch the shared encoder simultaneously. The resulting data race corrupts encoder state and panics the server process, denying service to all clients. Publicly available exploit code exists, and because the vector is network, unauthenticated, and requires no user interaction, triggering it only requires repeated requests to win the race window. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Earlier versions of this analysis (1)
Remote denial of service in the Go net/http HTTP/2 server lets an unauthenticated client crash the process by racing the server's HPACK encoder. The flaw affects Go releases before 1.27.2 and 1.26.9: while one goroutine encodes a HEADERS frame for a response, another applies a client-supplied SETTINGS_HEADER_TABLE_SIZE value, and because that shared encoder is modified without synchronization, a client that repeatedly sends requests while changing the header table size can panic the server. No CISA KEV listing, public exploit code, or EPSS score appears in the available data, and neither NVD nor the vendor supplied a CVSS vector (CVSS N/A), though the independently assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (High availability impact, High attack complexity, no authentication).
RemediationAI
Patch available per vendor advisory: upgrade to the Go toolchain release that contains the upstream fix, and where the module depends on golang.org/x/net/http2 directly, bump that module to the fixed version - the authoritative version guidance is in GO-2026-6617 (https://pkg.go.dev/vuln/GO-2026-6617) and the golang-announce threads (https://groups.google.com/g/golang-announce/c/U2fTuyDJznI, https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs), with the fixing change series visible at https://go.dev/cl/847188 and https://go.dev/cl/847313; the CVE record does not itself name an exact fix version, so confirm against the upstream release note before rollout. If immediate upgrading is not possible, the most effective compensating control is to stop offering HTTP/2 on TLS servers by setting the server's TLSNextProto field to a non-nil empty map (for example map[string]func(*http.Server, *tls.Conn, http.Handler){}), which forces clients down to HTTP/1.1 - the trade-off is loss of HTTP/2 multiplexing, header compression and server push, plus possible client fallback behavior changes. On the standard library's automatic HTTP/2 path, the GODEBUG setting http2server=0 disables the HTTP/2 server for the process, with the same loss of HTTP/2 capabilities and the added risk of forgetting it during a later upgrade. Edge mitigations such as rate-limiting requests per connection or interposing an HTTP/2 proxy that throttles or normalizes client SETTINGS frames can shrink the race window but do not eliminate it, because the proxy itself may run the vulnerable Go code and because throttling SETTINGS can break legitimate clients that legitimately resize the header table; they should be treated as temporary risk reduction only. Note that authentication and rate limiting on application endpoints are not reliable defenses here, since the race is triggered by protocol-level SETTINGS frames at PR:N/UI:N.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HTTP/2 compresses header blocks with HPACK, whose encoder owns a dynamic table that clients can resize by sending a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE. In Go's implementation, the connection's response-writing goroutine calls the HPACK encoder to emit a HEADERS frame while the frame-reading goroutine processes the incoming SETTINGS frame and mutates the same encoder's table size, with no mutex or other synchronization between them. That unsynchronized shared-state access is a classic CWE-362 race condition: it violates Go's memory model, can corrupt the encoder's internal table state, and may panic or otherwise tear down the connection/server goroutine, giving a remote denial of service. Only servers actually speaking HTTP/2 are exposed - net/http negotiates HTTP/2 by default on automatically configured TLS/HTTPS listeners, and code built directly on golang.org/x/net/http2 (including many Go proxies and API gateways that embed that package) is affected in the same way, while servers pinned to HTTP/1.1 are not.
Know when Golang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but a concurrency race requiring a won timing window justifies AC:H; impact is a server crash only, so C:N/I:N and A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Technical POC Analysis
Evidence caveat up front.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A high-severity flaw in Go's HTTP/2 server implementation (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) lets an unauthenticated remote attacker crash a running service by racing concurrent response encoding against header-table resize settings. Because the failure terminates the process, any customer-facing or internal Go workload with HTTP/2 enabled - APIs, gateways, and platform services - can suffer unplanned outages until the vendor fix is deployed. Publicly available exploit code exists, so remediation should be treated as time-bound, even though exploitation is timing-dependent and no confirmed actively exploited (CISA KEV) activity has been observed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
WAGO PFC200 G2 PLC (firmware affected) allows privilege escalation through cookie manipulation. Users can modify cookie
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.p
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI proc
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Free5gc NRF 1.4.0 has an authorization bypass in access token generation that allows authenticated users to request toke
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) all
Exploit-DB