CVE-2026-97032: Go Standard Library HTTP/2 Server Crash Due to HPACK Encoder Race Condition
Summary
CVE-2026-97032: HTTP/2 server crash due to HPACK encoder race in net/http. Affects stdlib across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-97032 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library provides essential functionality for building web servers and clients, including support for the HTTP/2 protocol. HTTP/2 is designed to improve performance and efficiency in web communications. However, the library's implementation of the HPACK encoder, which compresses header fields, has a critical flaw that can lead to server crashes under certain conditions.
Vulnerability Detail
The vulnerability arises from a race condition in the HPACK encoder used by HTTP/2 servers. Specifically, the encoder is modified concurrently by two goroutines: one encodes a HEADERS frame for a client response, while the other adjusts the encoder's table size in response to a SETTINGS frame sent by the client. This unsynchronized access can lead to a crash when a malicious client repeatedly sends requests with changing header table sizes, exploiting the race condition to disrupt server operations.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9go get stdlib@v1.26.9 -
>= 1.27.0-0, < 1.27.21.27.2go get stdlib@v1.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on incoming requests to mitigate the impact of a malicious client attempting to exploit this vulnerability. Additionally, consider using a reverse proxy that can handle such attacks more gracefully.
Conclusion
CVE-2026-97032 is a critical vulnerability in the Go standard library's HTTP/2 server that can lead to server crashes due to a race condition in the HPACK encoder. It is essential to update to the patched versions to ensure the security and stability of your applications. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for stdlib →
FAQ
CVE-2026-97032 is a vulnerability in the Go standard library's HTTP/2 server that can lead to server crashes due to a race condition in the HPACK encoder.
If your application uses the Go standard library's HTTP/2 server, it may be susceptible to crashes when a malicious client exploits the race condition.
Versions of the Go standard library prior to 1.26.9 and from 1.27.0-0 to 1.27.2 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update your Go version immediately, consider implementing rate limiting and using a reverse proxy to help mitigate potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
