CVE-2026-56853

Published: Aug 13, 2026Modified: Sep 3, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://go.dev/cl/795540

Source: security@golang.org

https://go.dev/issue/80205

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/94pEornpRlI

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2026-6089

Source: security@golang.org

Timeline

No history available yet.