VDB
CVE-2026-78663
CVE-2026-78663
PUBLISHED
CVSS 9.1 CRITICAL
Reported by Go · Published October 8, 2026
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Risk Scores
CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/http | 0 |
| Go standard library | net/http/internal/http2 | 1.27.0-0 |
| golang.org/x/net | golang.org/x/net/http2 | 0 |
| wolfi | dockerize | * |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 0 |
| chainguard | virt-controller-fips-1.7 | 0, 0 |
| chainguard | supercronic-fips | 0 |
| chainguard | db-operator | 0 |
| chainguard | redis-operator-fips | 0 |
| chainguard | crossplane-provider-aws-cloudfront | 0 |
| chainguard | cloud-sql-proxy-2.21 | 0 |
| chainguard | opencost | 0 |
| chainguard | fluxcd-kustomize-mutating-webhook-fips | 0 |
| chainguard | crossplane-provider-aws-redshiftserverless | 0 |
| chainguard | crossplane-provider-aws-iam | 0 |
| wolfi | telegraf-1.38 | 0 |
| chainguard | consul-k8s-fips-1.5 | 0 |
| chainguard | docker-machine-driver-harvester | 0 |
| wolfi | crossplane-provider-aws-sns | 0 |
| chainguard | kueue-0.19 | 0 |
…and 3722 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score