Net Http Internal Http2
Monthly
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
Response smuggling is possible in Go's HTTP/2 implementation (net/http and golang.org/x/net/http2) when a program acts as a reverse proxy that receives an HTTP/2 upstream response and forwards it to a downstream HTTP/1 client. Because Go has historically not rejected malformed framing-related headers such as connection-specific or length-related headers that RFC 7540 requires to be treated as malformed, those headers can be relayed verbatim; if the downstream HTTP/1 client is also lenient in parsing, the attacker can desynchronize the response stream and smuggle content. The issue is unauthenticated from the network perspective (CVSS PR:N) but exploitation is constrained to that specific proxy topology and requires attacker influence over the upstream response plus a non-strict HTTP/1 client; there is no public exploit identified at time of analysis, EPSS is low at 0.19% (8th percentile), and CISA SSVC records no exploitation with partial technical impact.
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
Response smuggling is possible in Go's HTTP/2 implementation (net/http and golang.org/x/net/http2) when a program acts as a reverse proxy that receives an HTTP/2 upstream response and forwards it to a downstream HTTP/1 client. Because Go has historically not rejected malformed framing-related headers such as connection-specific or length-related headers that RFC 7540 requires to be treated as malformed, those headers can be relayed verbatim; if the downstream HTTP/1 client is also lenient in parsing, the attacker can desynchronize the response stream and smuggle content. The issue is unauthenticated from the network perspective (CVSS PR:N) but exploitation is constrained to that specific proxy topology and requires attacker influence over the upstream response plus a non-strict HTTP/1 client; there is no public exploit identified at time of analysis, EPSS is low at 0.19% (8th percentile), and CISA SSVC records no exploitation with partial technical impact.