| { |
| "schema_version": "1.3.1", |
| "id": "GO-2026-6611", |
| "modified": "0001-01-01T00:00:00Z", |
| "published": "0001-01-01T00:00:00Z", |
| "aliases": [ |
| "CVE-2026-78669" |
| ], |
| "summary": "Excessive CPU consumption from repeated initial window changes in net/http", |
| "details": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", |
| "affected": [ |
| { |
| "package": { |
| "name": "stdlib", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "1.26.9" |
| } |
| ] |
| } |
| ], |
| "ecosystem_specific": { |
| "imports": [ |
| { |
| "path": "net/http", |
| "symbols": [ |
| "CanonicalHeaderKey", |
| "Client.CloseIdleConnections", |
| "Client.Do", |
| "Client.Get", |
| "Client.Head", |
| "Client.Post", |
| "Client.PostForm", |
| "ClientConn.Close", |
| "ClientConn.RoundTrip", |
| "Cookie.String", |
| "Cookie.Valid", |
| "CrossOriginProtection.AddInsecureBypassPattern", |
| "CrossOriginProtection.AddTrustedOrigin", |
| "CrossOriginProtection.Check", |
| "Dir.Open", |
| "Error", |
| "Get", |
| "Handle", |
| "HandleFunc", |
| "HandlerFunc.ServeHTTP", |
| "Head", |
| "Header.Add", |
| "Header.Del", |
| "Header.Get", |
| "Header.Set", |
| "Header.Values", |
| "Header.Write", |
| "Header.WriteSubset", |
| "ListenAndServe", |
| "ListenAndServeTLS", |
| "NewRequest", |
| "NewRequestWithContext", |
| "NotFound", |
| "ParseCookie", |
| "ParseSetCookie", |
| "ParseTime", |
| "Post", |
| "PostForm", |
| "ProxyFromEnvironment", |
| "ReadRequest", |
| "ReadResponse", |
| "Redirect", |
| "Request.AddCookie", |
| "Request.BasicAuth", |
| "Request.Cookie", |
| "Request.Cookies", |
| "Request.CookiesNamed", |
| "Request.FormFile", |
| "Request.FormValue", |
| "Request.MultipartReader", |
| "Request.ParseForm", |
| "Request.ParseMultipartForm", |
| "Request.PostFormValue", |
| "Request.Referer", |
| "Request.SetBasicAuth", |
| "Request.UserAgent", |
| "Request.Write", |
| "Request.WriteProxy", |
| "Response.Cookies", |
| "Response.Location", |
| "Response.Write", |
| "ResponseController.EnableFullDuplex", |
| "ResponseController.Flush", |
| "ResponseController.Hijack", |
| "ResponseController.SetReadDeadline", |
| "ResponseController.SetWriteDeadline", |
| "Serve", |
| "ServeContent", |
| "ServeFile", |
| "ServeFileFS", |
| "ServeMux.Handle", |
| "ServeMux.HandleFunc", |
| "ServeMux.ServeHTTP", |
| "ServeTLS", |
| "Server.Close", |
| "Server.ListenAndServe", |
| "Server.ListenAndServeTLS", |
| "Server.Serve", |
| "Server.ServeTLS", |
| "Server.SetKeepAlivesEnabled", |
| "Server.Shutdown", |
| "SetCookie", |
| "Transport.CancelRequest", |
| "Transport.Clone", |
| "Transport.CloseIdleConnections", |
| "Transport.NewClientConn", |
| "Transport.RoundTrip", |
| "body.Close", |
| "body.Read", |
| "bodyEOFSignal.Close", |
| "bodyEOFSignal.Read", |
| "bodyLocked.Read", |
| "bufioFlushWriter.Write", |
| "cancelTimerBody.Close", |
| "cancelTimerBody.Read", |
| "checkConnErrorWriter.Write", |
| "chunkWriter.Write", |
| "connReader.Read", |
| "connectMethodKey.String", |
| "expectContinueReader.Close", |
| "expectContinueReader.Read", |
| "extraHeader.Write", |
| "fileHandler.ServeHTTP", |
| "fileTransport.RoundTrip", |
| "globalOptionsHandler.ServeHTTP", |
| "gzipReader.Close", |
| "gzipReader.Read", |
| "http1ClientConn.Close", |
| "http1ClientConn.RoundTrip", |
| "http2ClientConn.Close", |
| "http2ClientConn.Ping", |
| "http2ClientConn.RoundTrip", |
| "http2ClientConn.Shutdown", |
| "http2ClientConn.addStreamLocked", |
| "http2ConnectionError.Error", |
| "http2ErrCode.String", |
| "http2FrameHeader.String", |
| "http2FrameType.String", |
| "http2FrameWriteRequest.Consume", |
| "http2FrameWriteRequest.String", |
| "http2Framer.ReadFrame", |
| "http2Framer.ReadFrameForHeader", |
| "http2Framer.ReadFrameHeader", |
| "http2Framer.WriteContinuation", |
| "http2Framer.WriteData", |
| "http2Framer.WriteDataPadded", |
| "http2Framer.WriteGoAway", |
| "http2Framer.WriteHeaders", |
| "http2Framer.WritePing", |
| "http2Framer.WritePriority", |
| "http2Framer.WritePushPromise", |
| "http2Framer.WriteRSTStream", |
| "http2Framer.WriteRawFrame", |
| "http2Framer.WriteSettings", |
| "http2Framer.WriteSettingsAck", |
| "http2Framer.WriteWindowUpdate", |
| "http2GoAwayError.Error", |
| "http2Server.ServeConn", |
| "http2Server.serveConn", |
| "http2Setting.String", |
| "http2SettingID.String", |
| "http2SettingsFrame.ForeachSetting", |
| "http2StreamError.Error", |
| "http2Transport.CloseIdleConnections", |
| "http2Transport.NewClientConn", |
| "http2Transport.RoundTrip", |
| "http2Transport.RoundTripOpt", |
| "http2Transport.newClientConn", |
| "http2bufferedWriter.Flush", |
| "http2bufferedWriter.Write", |
| "http2bufferedWriterTimeoutWriter.Write", |
| "http2chunkWriter.Write", |
| "http2clientConnPool.GetClientConn", |
| "http2clientConnReadLoop.processSettingsNoWrite", |
| "http2clientConnReadLoop.processWindowUpdate", |
| "http2clientConnReadLoop.streamByID", |
| "http2clientStream.awaitFlowControl", |
| "http2clientStream.cleanupWriteRequest", |
| "http2connError.Error", |
| "http2dataBuffer.Read", |
| "http2duplicatePseudoHeaderError.Error", |
| "http2gzipReader.Close", |
| "http2gzipReader.Read", |
| "http2headerFieldNameError.Error", |
| "http2headerFieldValueError.Error", |
| "http2netHTTPClientConn.Close", |
| "http2netHTTPClientConn.RoundTrip", |
| "http2noDialClientConnPool.GetClientConn", |
| "http2noDialH2RoundTripper.NewClientConn", |
| "http2noDialH2RoundTripper.RoundTrip", |
| "http2outflow.add", |
| "http2outflow.available", |
| "http2outflow.setConnFlow", |
| "http2outflow.take", |
| "http2pipe.Read", |
| "http2priorityWriteSchedulerRFC7540.CloseStream", |
| "http2priorityWriteSchedulerRFC7540.OpenStream", |
| "http2priorityWriteSchedulerRFC7540.Pop", |
| "http2priorityWriteSchedulerRFC9218.OpenStream", |
| "http2priorityWriteSchedulerRFC9218.Pop", |
| "http2pseudoHeaderError.Error", |
| "http2randomWriteScheduler.Pop", |
| "http2requestBody.Close", |
| "http2requestBody.Read", |
| "http2responseWriter.Flush", |
| "http2responseWriter.FlushError", |
| "http2responseWriter.Push", |
| "http2responseWriter.SetReadDeadline", |
| "http2responseWriter.SetWriteDeadline", |
| "http2responseWriter.Write", |
| "http2responseWriter.WriteHeader", |
| "http2responseWriter.WriteString", |
| "http2roundRobinWriteScheduler.OpenStream", |
| "http2roundRobinWriteScheduler.Pop", |
| "http2serverConn.CloseConn", |
| "http2serverConn.Flush", |
| "http2serverConn.newStream", |
| "http2serverConn.processSettingInitialWindowSize", |
| "http2serverConn.processWindowUpdate", |
| "http2serverConn.scheduleFrameWrite", |
| "http2stickyErrWriter.Write", |
| "http2transportResponseBody.Close", |
| "http2transportResponseBody.Read", |
| "http2unencryptedTransport.RoundTrip", |
| "http2writeData.String", |
| "initALPNRequest.ServeHTTP", |
| "loggingConn.Close", |
| "loggingConn.Read", |
| "loggingConn.Write", |
| "maxBytesReader.Close", |
| "maxBytesReader.Read", |
| "onceCloseListener.Close", |
| "persistConn.Read", |
| "persistConnWriter.ReadFrom", |
| "persistConnWriter.Write", |
| "populateResponse.Write", |
| "populateResponse.WriteHeader", |
| "readTrackingBody.Close", |
| "readTrackingBody.Read", |
| "readWriteCloserBody.CloseWrite", |
| "readWriteCloserBody.Read", |
| "redirectHandler.ServeHTTP", |
| "response.Flush", |
| "response.FlushError", |
| "response.Hijack", |
| "response.ReadFrom", |
| "response.Write", |
| "response.WriteHeader", |
| "response.WriteString", |
| "serverHandler.ServeHTTP", |
| "socksDialer.DialWithConn", |
| "socksUsernamePassword.Authenticate", |
| "stringWriter.WriteString", |
| "timeoutHandler.ServeHTTP", |
| "timeoutWriter.Write", |
| "timeoutWriter.WriteHeader", |
| "transportReadFromServerError.Error", |
| "unencryptedHTTP2Request.ServeHTTP" |
| ] |
| } |
| ] |
| } |
| }, |
| { |
| "package": { |
| "name": "stdlib", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "1.27.0-0" |
| }, |
| { |
| "fixed": "1.27.2" |
| } |
| ] |
| } |
| ], |
| "ecosystem_specific": { |
| "imports": [ |
| { |
| "path": "net/http/internal/http2", |
| "symbols": [ |
| "ClientConn.Close", |
| "ClientConn.Ping", |
| "ClientConn.RoundTrip", |
| "ClientConn.Shutdown", |
| "ClientConn.addStreamLocked", |
| "FrameWriteRequest.Consume", |
| "Framer.ReadFrame", |
| "Framer.ReadFrameForHeader", |
| "Framer.ReadFrameHeader", |
| "Framer.WriteContinuation", |
| "Framer.WriteData", |
| "Framer.WriteDataPadded", |
| "Framer.WriteGoAway", |
| "Framer.WriteHeaders", |
| "Framer.WritePing", |
| "Framer.WritePriority", |
| "Framer.WritePriorityUpdate", |
| "Framer.WritePushPromise", |
| "Framer.WriteRSTStream", |
| "Framer.WriteRawFrame", |
| "Framer.WriteSettings", |
| "Framer.WriteSettingsAck", |
| "Framer.WriteWindowUpdate", |
| "NetHTTPClientConn.Close", |
| "NetHTTPClientConn.Ping", |
| "NetHTTPClientConn.RoundTrip", |
| "ReadFrameHeader", |
| "Server.GracefulShutdown", |
| "Server.ServeConn", |
| "Server.serveConn", |
| "SettingsFrame.ForeachSetting", |
| "Transport.AddConn", |
| "Transport.CloseIdleConnections", |
| "Transport.NewClientConn", |
| "Transport.RoundTrip", |
| "Transport.RoundTripOpt", |
| "Transport.newClientConn", |
| "bufferedWriter.Flush", |
| "bufferedWriter.Write", |
| "bufferedWriterTimeoutWriter.Write", |
| "chunkWriter.Write", |
| "clientConnPool.GetClientConn", |
| "clientConnReadLoop.processSettingsNoWrite", |
| "clientConnReadLoop.processWindowUpdate", |
| "clientConnReadLoop.streamByID", |
| "clientStream.awaitFlowControl", |
| "clientStream.cleanupWriteRequest", |
| "gzipReader.Close", |
| "gzipReader.Read", |
| "noDialClientConnPool.GetClientConn", |
| "outflow.add", |
| "outflow.available", |
| "outflow.setConnFlow", |
| "outflow.take", |
| "priorityWriteSchedulerRFC9218.Pop", |
| "requestBody.Close", |
| "responseWriter.Flush", |
| "responseWriter.FlushError", |
| "responseWriter.Push", |
| "responseWriter.Write", |
| "responseWriter.WriteHeader", |
| "responseWriter.WriteString", |
| "roundRobinWriteScheduler.Pop", |
| "serve400Handler.ServeHTTP", |
| "serverConn.Flush", |
| "serverConn.newStream", |
| "serverConn.processSettingInitialWindowSize", |
| "serverConn.processWindowUpdate", |
| "serverConn.scheduleFrameWrite", |
| "stickyErrWriter.Write", |
| "transportResponseBody.Close", |
| "transportResponseBody.Read" |
| ] |
| } |
| ] |
| } |
| }, |
| { |
| "package": { |
| "name": "golang.org/x/net", |
| "ecosystem": "Go" |
| }, |
| "ranges": [ |
| { |
| "type": "SEMVER", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "0.60.0" |
| } |
| ] |
| } |
| ], |
| "ecosystem_specific": { |
| "imports": [ |
| { |
| "path": "golang.org/x/net/http2", |
| "symbols": [ |
| "ClientConn.Close", |
| "ClientConn.Ping", |
| "ClientConn.RoundTrip", |
| "ClientConn.Shutdown", |
| "ClientConn.addStreamLocked", |
| "ConfigureServer", |
| "ConfigureTransport", |
| "ConfigureTransports", |
| "ConnectionError.Error", |
| "ErrCode.String", |
| "FrameHeader.String", |
| "FrameType.String", |
| "FrameWriteRequest.Consume", |
| "FrameWriteRequest.String", |
| "Framer.ReadFrame", |
| "Framer.ReadFrameForHeader", |
| "Framer.ReadFrameHeader", |
| "Framer.WriteContinuation", |
| "Framer.WriteData", |
| "Framer.WriteDataPadded", |
| "Framer.WriteGoAway", |
| "Framer.WriteHeaders", |
| "Framer.WritePing", |
| "Framer.WritePriority", |
| "Framer.WritePriorityUpdate", |
| "Framer.WritePushPromise", |
| "Framer.WriteRSTStream", |
| "Framer.WriteRawFrame", |
| "Framer.WriteSettings", |
| "Framer.WriteSettingsAck", |
| "Framer.WriteWindowUpdate", |
| "GoAwayError.Error", |
| "ReadFrameHeader", |
| "Server.ServeConn", |
| "Server.serveConn", |
| "Setting.String", |
| "SettingID.String", |
| "SettingsFrame.ForeachSetting", |
| "StreamError.Error", |
| "Transport.CloseIdleConnections", |
| "Transport.NewClientConn", |
| "Transport.RoundTrip", |
| "Transport.RoundTripOpt", |
| "Transport.newClientConn", |
| "bufferedWriter.Flush", |
| "bufferedWriter.Write", |
| "bufferedWriterTimeoutWriter.Write", |
| "chunkWriter.Write", |
| "clientConnPool.GetClientConn", |
| "clientConnReadLoop.processSettingsNoWrite", |
| "clientConnReadLoop.processWindowUpdate", |
| "clientConnReadLoop.streamByID", |
| "clientStream.awaitFlowControl", |
| "clientStream.cleanupWriteRequest", |
| "connError.Error", |
| "dataBuffer.Read", |
| "duplicatePseudoHeaderError.Error", |
| "gzipReader.Close", |
| "gzipReader.Read", |
| "headerFieldNameError.Error", |
| "headerFieldValueError.Error", |
| "netHTTPClientConn.Close", |
| "netHTTPClientConn.RoundTrip", |
| "noDialClientConnPool.GetClientConn", |
| "noDialH2RoundTripper.NewClientConn", |
| "noDialH2RoundTripper.RoundTrip", |
| "outflow.add", |
| "outflow.available", |
| "outflow.setConnFlow", |
| "outflow.take", |
| "pipe.Read", |
| "priorityWriteSchedulerRFC7540.CloseStream", |
| "priorityWriteSchedulerRFC7540.OpenStream", |
| "priorityWriteSchedulerRFC7540.Pop", |
| "priorityWriteSchedulerRFC9218.OpenStream", |
| "priorityWriteSchedulerRFC9218.Pop", |
| "pseudoHeaderError.Error", |
| "randomWriteScheduler.Pop", |
| "requestBody.Close", |
| "requestBody.Read", |
| "responseWriter.Flush", |
| "responseWriter.FlushError", |
| "responseWriter.Push", |
| "responseWriter.SetReadDeadline", |
| "responseWriter.SetWriteDeadline", |
| "responseWriter.Write", |
| "responseWriter.WriteHeader", |
| "responseWriter.WriteString", |
| "roundRobinWriteScheduler.OpenStream", |
| "roundRobinWriteScheduler.Pop", |
| "serverConn.CloseConn", |
| "serverConn.Flush", |
| "serverConn.newStream", |
| "serverConn.processSettingInitialWindowSize", |
| "serverConn.processWindowUpdate", |
| "serverConn.scheduleFrameWrite", |
| "stickyErrWriter.Write", |
| "transportResponseBody.Close", |
| "transportResponseBody.Read", |
| "unencryptedTransport.RoundTrip", |
| "writeData.String" |
| ] |
| } |
| ] |
| } |
| } |
| ], |
| "references": [ |
| { |
| "type": "FIX", |
| "url": "https://go.dev/cl/847186" |
| }, |
| { |
| "type": "FIX", |
| "url": "https://go.dev/cl/847308" |
| }, |
| { |
| "type": "REPORT", |
| "url": "https://go.dev/issue/81742" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" |
| } |
| ], |
| "credits": [ |
| { |
| "name": "Jakub Ciolek (https://ciolek.dev)" |
| } |
| ], |
| "database_specific": { |
| "url": "https://pkg.go.dev/vuln/GO-2026-6611", |
| "review_status": "REVIEWED" |
| } |
| } |
