CVE-2026-78669

Published: Oct 8, 2026Modified: Oct 9, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Related CWEs

CWE-405

Asymmetric Resource Consumption (Amplification)

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

References (6)

https://go.dev/cl/847186

Source: security@golang.org

https://go.dev/cl/847308

Source: security@golang.org

https://go.dev/issue/81742

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2026-6611

Source: security@golang.org

Timeline

No history available yet.