CVE-2026-78669: Golang Excessive CPU Consumption Due to HTTP/2 SETTINGS Manipulation
Summary
CVE-2026-78669: Excessive CPU consumption from repeated initial window changes in net/http. Affects golang across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-78669 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency in building scalable and high-performance applications. It is widely used for web development, cloud services, and networking applications. However, it is vulnerable to a specific issue in its net/http package, where a malicious HTTP/2 peer can exploit the SETTINGS frames to cause excessive CPU consumption.
Vulnerability Detail
The vulnerability arises when a malicious HTTP/2 peer opens a large number of streams and sends numerous small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. This can lead to excessive CPU consumption on both the client and server sides, potentially degrading performance and causing denial of service. The issue is particularly concerning in environments where resource management is critical, as it can lead to unresponsive applications and increased operational costs.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9 -
>= 1.27.0-0, < 1.27.21.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on the number of streams that can be opened by a single peer, or monitor and restrict the frequency of SETTINGS frame updates to mitigate the impact of this vulnerability.
Conclusion
CVE-2026-78669 presents a significant risk to applications using the Golang net/http package, leading to excessive CPU consumption through malicious HTTP/2 peer interactions. It is crucial to update to the patched versions to mitigate this risk and ensure application stability.
See every vulnerability recorded for golang →
FAQ
CVE-2026-78669 is a vulnerability in the Golang net/http package that allows a malicious HTTP/2 peer to cause excessive CPU consumption.
This vulnerability can lead to performance degradation and denial of service, making your application unresponsive under certain conditions.
All versions prior to 1.26.9 and 1.27.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, implement rate limiting on streams or monitor SETTINGS frame updates as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
