CVE-2026-78663: Go Standard Library HTTP/2 Server Double Flow Control Refund Vulnerability
Summary
CVE-2026-78663: Double flow control refund on HTTP/2 server streams in net/http. Affects stdlib across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-78663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Standard Library provides essential packages for building web servers and clients. The 'net/http' package, in particular, is widely used for handling HTTP requests and responses. This package supports HTTP/2, which enhances performance through multiplexing and flow control. However, a vulnerability has been identified that allows a malicious client to exploit the flow control mechanism, potentially leading to resource exhaustion and denial of service.
Vulnerability Detail
The vulnerability arises from a flaw in the HTTP/2 server's flow control mechanism, where it can refund connection-level flow control twice for the same data. This occurs when a client resets a stream and again when a request handler reads buffered data. A malicious client can exploit this behavior to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection), leading to excessive resource consumption. The total buffered data remains limited by the concurrent stream limit and stream-level flow control, but this double refund can still be detrimental.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9go get stdlib@v1.26.9 -
>= 1.27.0-0, < 1.27.21.27.2go get stdlib@v1.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent streams or adjust the flow control settings in your server configuration to mitigate the impact of this vulnerability until an upgrade can be performed.
Conclusion
The CVE-2026-78663 vulnerability in the Go Standard Library's HTTP/2 server poses a significant risk by allowing malicious clients to exploit flow control mechanisms. It is crucial to update to the patched versions to safeguard your applications against potential resource exhaustion and denial of service attacks.
See every vulnerability recorded for stdlib →
FAQ
CVE-2026-78663 is a vulnerability in the Go Standard Library's HTTP/2 server that allows a malicious client to exploit the flow control mechanism, potentially leading to resource exhaustion.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions of the Go Standard Library prior to 1.26.9 and those starting from 1.27.0-0 before 1.27.2 are affected by this vulnerability.
Exploitation of this vulnerability can lead to resource exhaustion, resulting in denial of service for legitimate users of the affected application.
You can limit the number of concurrent streams or adjust flow control settings in your server configuration as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
