CVE-2026-78669: Excessive CPU Consumption in Go's net/http Package
Summary
CVE-2026-78669: Excessive CPU consumption from repeated initial window changes in net/http. Affects stdlib across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-78669 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language's standard library includes the net/http package, which provides HTTP client and server implementations. This package is widely used for building web applications and services, offering features such as handling HTTP requests, responses, and connections. However, it is susceptible to vulnerabilities that can lead to performance degradation, such as excessive CPU consumption caused by malicious HTTP/2 peers.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of HTTP/2 streams within the net/http package. A malicious peer can exploit this by opening numerous streams and sending small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. This can lead to excessive CPU consumption on both the client and server sides, potentially causing denial of service conditions. The issue is particularly concerning for applications that rely heavily on HTTP/2 for communication, as it can degrade performance and responsiveness.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9go get stdlib@v1.26.9 -
>= 1.27.0-0, < 1.27.21.27.2go get stdlib@v1.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent streams or implement rate limiting on your HTTP/2 connections to mitigate the impact of this vulnerability until you can apply the patch.
Conclusion
CVE-2026-78669 represents a significant vulnerability in the Go net/http package, leading to excessive CPU consumption through malicious HTTP/2 peer interactions. It is crucial for developers to update their Go installations to the patched versions to mitigate this risk and ensure the stability and performance of their applications.
See every vulnerability recorded for stdlib →
FAQ
CVE-2026-78669 is a vulnerability in the Go programming language's net/http package that allows a malicious HTTP/2 peer to cause excessive CPU consumption.
If your application uses the net/http package and relies on HTTP/2, it may experience performance issues or denial of service due to excessive CPU usage.
Versions of Go prior to 1.26.9 and 1.27.0-0 up to 1.27.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update your Go version immediately, consider implementing rate limiting or limiting the number of concurrent streams to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
