VDB
CVE-2026-97032
CVE-2026-97032
PUBLISHED
CVSS 7.5 HIGH
Reported by Go · Published October 8, 2026
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/http | 0 |
| Go standard library | net/http/internal/http2 | 1.27.0-0 |
| golang.org/x/net | golang.org/x/net/http2 | 0 |
| chainguard | aws-nuke | 0 |
| chainguard | commercial-gitlab-workhorse-ee-fips-19.4 | 0, 0 |
| chainguard | bank-vaults-fips | 0 |
| chainguard | crossplane-provider-aws-efs-fips | 0 |
| chainguard | dragonfly-operator | 0 |
| chainguard | undock | 0 |
| chainguard | consul-k8s-fips-1.3 | 0 |
| chainguard | opentofu-fips-1.10 | 0 |
| chainguard | crossplane-provider-aws-amplify | 0 |
| chainguard | argo-workflows-fips-4.1 | 0 |
| chainguard | tekton-pipelines-1.6 | * |
| wolfi | gitlab-kas-19.2 | 0 |
| chainguard | external-dns-0.22 | 0 |
| chainguard | crossplane-provider-aws-scheduler-fips | 0 |
| wolfi | cluster-api-ipam-provider-in-cluster | 0 |
| chainguard | kube-vip-fips | 0 |
| chainguard | local-static-provisioner-fips | 0 |
…and 3722 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 14, 2026 EPSS Score
- Oct 15, 2026 CVE Updated
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 26, 2026 Distribution Patch
- Oct 27, 2026 Distribution Patch
- Oct 28, 2026 Distribution Patch