VDB
GO-2026-6603
GO-2026-6603
PUBLISHED
CVSS 8.699999809265137 HIGH
Record from OSV · Published October 8, 2026
HTTP/2 server memory exhaustion due to Trailer headers in net/http
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| cadence-fips | Chainguard | 1.4.2-r3 |
| kiali-fips | Chainguard | 2.33.0-r2 |
| cert-manager-openshift-routes-fips | Chainguard | 0.11.0-r2 |
| buildkitd | Wolfi | 0.34.0-r1 |
| splunk-otel-collector | Wolfi | 0.162.0-r2 |
| vault-1.21 | Chainguard | 1.21.4-r22 |
| cilium-cli | Chainguard | 0.20.1-r3 |
| malcontent | Chainguard | 1.27.1-r1 |
| commercial-chainloop-cli | Chainguard | 1.72.2-r10 |
| cluster-api-provider-vsphere | Chainguard | 1.17.0-r5 |
| stunnerd | Chainguard | 1.2.1-r13 |
| cert-manager-istio-csr | Wolfi | 0.18.0-r2 |
87 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | kiali-fips | 0 |
| chainguard | malcontent | 0 |
| chainguard | commercial-chainloop-cli | 0 |
| chainguard | stunnerd | 0 |
| chainguard | node-problem-detector-1.34 | * |
| wolfi | cert-manager-istio-csr | 0 |
| chainguard | tflintenv-fips | * |
| chainguard | cloudbeat-9.2 | 0 |
| chainguard | gomplate-fips-5 | 0 |
| wolfi | kubernetes-csi-external-health-monitor | 0 |
| chainguard | crossplane-provider-aws-cognitoidentity-fips | 0 |
| chainguard | neuvector-fips | 0 |
| chainguard | sqs-controller-fips | 0 |
| chainguard | crossplane-provider-aws-ecs | 0 |
| chainguard | dynatrace-operator | 0 |
| chainguard | crossplane-provider-aws-redshift | 0 |
| chainguard | cloudprober-fips | 0 |
| chainguard | porch-fips | 0 |
| chainguard | gitlab-cng-fips-19.2 | * |
| chainguard | longhorn-manager-1.11 | 0 |
…and 3718 more
Timeline
- Oct 8, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2026-6603
vulnetix vdb fixes GO-2026-6603Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6603/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart