CVE-2026-78660

Published: Oct 8, 2026Modified: Oct 9, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Related CWEs

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (5)

https://go.dev/cl/835145

Source: security@golang.org

https://go.dev/cl/836385

Source: security@golang.org

https://go.dev/issue/81115

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2026-6610

Source: security@golang.org

Timeline

No history available yet.