VDB
CVE-2026-78669
CVE-2026-78669
PUBLISHED
CVSS 7.5 HIGH
Reported by Go · Published October 8, 2026
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/http | 0 |
| Go standard library | net/http/internal/http2 | 1.27.0-0 |
| golang.org/x/net | golang.org/x/net/http2 | 0 |
| chainguard | consul-k8s-1.4 | 0 |
| chainguard | tekton-pipelines-fips-1.15 | * |
| chainguard | aws-efs-csi-driver | 0 |
| chainguard | gitaly-fips-19.3 | * |
| chainguard | k6-operator | 0 |
| chainguard | k8s-metacollector | 0 |
| chainguard | aws-ebs-csi-driver-fips-1.65 | 0 |
| chainguard | cert-manager-fips-1.21 | * |
| chainguard | cloud-provider-azure-1.33 | 0 |
| chainguard | haproxy-ingress-0.14 | 0 |
| wolfi | gcsfuse | 0 |
| chainguard | tigera-operator-1.42 | 0 |
| chainguard | rancher-webhook-fips-0.11 | 0 |
| chainguard | crossplane-provider-aws-cloudformation | 0 |
| chainguard | prometheus-node-exporter-1.5 | * |
| chainguard | rancher-pushprox | 0 |
| chainguard | emqx-exporter | * |
…and 3738 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Security Advisory