CVE-2026-78663: Golang HTTP/2 Server Double Flow Control Refund Vulnerability
Summary
CVE-2026-78663: Double flow control refund on HTTP/2 server streams in net/http. Affects golang across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-78663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other applications. The net/http package in Golang provides HTTP client and server implementations, allowing developers to create robust web applications. However, a vulnerability has been identified in the HTTP/2 server streams that can lead to improper flow control management, potentially allowing malicious clients to exploit the system.
Vulnerability Detail
The vulnerability arises from the HTTP/2 server's handling of flow control refunds. When a client resets a stream, the server refunds the connection-level flow control for any data sent but not read. This refund can occur again when the request handler reads the buffered data. As a result, a malicious client can exploit this behavior to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Although the total buffered data is still limited by the concurrent stream limit and stream-level flow control, this double refund can lead to resource exhaustion and denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9 -
>= 1.27.0-0, < 1.27.21.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing strict input validation on client requests to mitigate the risk of malicious exploitation. Additionally, monitor the flow control limits closely to prevent resource exhaustion.
Conclusion
The CVE-2026-78663 vulnerability in Golang's HTTP/2 server poses a significant risk by allowing double flow control refunds. It is crucial for developers to update their Golang packages to the patched versions to safeguard their applications against potential exploitation.
See every vulnerability recorded for golang →
FAQ
CVE-2026-78663 is a vulnerability in the Golang HTTP/2 server that allows double flow control refunds, potentially leading to resource exhaustion.
You can use Vulert to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
The vulnerability can allow a malicious client to bypass flow control limits, leading to resource exhaustion and possible denial of service.
Yes, the vulnerability has been patched in Golang versions 1.26.9 and 1.27.2. It is recommended to update to these versions.
Implement strict input validation on client requests and monitor flow control limits to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
