VDB
CVE-2026-78660
CVE-2026-78660
PUBLISHED
CVSS 7.5 HIGH
Reported by Go · Published October 8, 2026
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/http | 0 |
| Go standard library | net/http/internal/http2 | 1.27.0-0 |
| golang.org/x/net | golang.org/x/net/http2 | 0 |
| chainguard | pinniped-fips | * |
| chainguard | flux-fips-2.8 | 0 |
| chainguard | grafana-postgresql-datasource | * |
| wolfi | newrelic-nri-statsd | * |
| chainguard | longhorn-backing-image-manager-fips-1.10 | 0 |
| chainguard | crossplane-provider-aws-kafka | 0 |
| chainguard | cert-manager-webhook-pdns-fips | 0 |
| chainguard | kates | 0 |
| chainguard | kubernetes-csi-external-snapshotter-fips-8.4 | 0 |
| chainguard | kubescape | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0, 0 |
| chainguard | prometheus-stackdriver-exporter-fips | 0 |
| chainguard | crossplane-function-patch-and-transform | * |
| chainguard | karpenter-fips-1.14 | 0 |
| chainguard | bank-vaults-vault-operator | 0 |
| chainguard | kubescape-operator | 0 |
| chainguard | consul-fips-2.0 | 0 |
…and 3741 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 26, 2026 Distribution Patch