| id: GO-2026-6617 |
| modules: |
| - module: std |
| versions: |
| - fixed: 1.26.9 |
| vulnerable_at: 1.26.8 |
| packages: |
| - package: net/http |
| symbols: |
| - http2serverConn.processSetting |
| - http2serverConn.startFrameWrite |
| derived_symbols: |
| - CanonicalHeaderKey |
| - Client.CloseIdleConnections |
| - Client.Do |
| - Client.Get |
| - Client.Head |
| - Client.Post |
| - Client.PostForm |
| - ClientConn.Close |
| - ClientConn.RoundTrip |
| - Cookie.String |
| - Cookie.Valid |
| - CrossOriginProtection.AddInsecureBypassPattern |
| - CrossOriginProtection.AddTrustedOrigin |
| - CrossOriginProtection.Check |
| - Dir.Open |
| - Error |
| - Get |
| - Handle |
| - HandleFunc |
| - HandlerFunc.ServeHTTP |
| - Head |
| - Header.Add |
| - Header.Del |
| - Header.Get |
| - Header.Set |
| - Header.Values |
| - Header.Write |
| - Header.WriteSubset |
| - ListenAndServe |
| - ListenAndServeTLS |
| - NewRequest |
| - NewRequestWithContext |
| - NotFound |
| - ParseCookie |
| - ParseSetCookie |
| - ParseTime |
| - Post |
| - PostForm |
| - ProxyFromEnvironment |
| - ReadRequest |
| - ReadResponse |
| - Redirect |
| - Request.AddCookie |
| - Request.BasicAuth |
| - Request.Cookie |
| - Request.Cookies |
| - Request.CookiesNamed |
| - Request.FormFile |
| - Request.FormValue |
| - Request.MultipartReader |
| - Request.ParseForm |
| - Request.ParseMultipartForm |
| - Request.PostFormValue |
| - Request.Referer |
| - Request.SetBasicAuth |
| - Request.UserAgent |
| - Request.Write |
| - Request.WriteProxy |
| - Response.Cookies |
| - Response.Location |
| - Response.Write |
| - ResponseController.EnableFullDuplex |
| - ResponseController.Flush |
| - ResponseController.Hijack |
| - ResponseController.SetReadDeadline |
| - ResponseController.SetWriteDeadline |
| - Serve |
| - ServeContent |
| - ServeFile |
| - ServeFileFS |
| - ServeMux.Handle |
| - ServeMux.HandleFunc |
| - ServeMux.ServeHTTP |
| - ServeTLS |
| - Server.Close |
| - Server.ListenAndServe |
| - Server.ListenAndServeTLS |
| - Server.Serve |
| - Server.ServeTLS |
| - Server.SetKeepAlivesEnabled |
| - Server.Shutdown |
| - SetCookie |
| - Transport.CancelRequest |
| - Transport.Clone |
| - Transport.CloseIdleConnections |
| - Transport.NewClientConn |
| - Transport.RoundTrip |
| - body.Close |
| - body.Read |
| - bodyEOFSignal.Close |
| - bodyEOFSignal.Read |
| - bodyLocked.Read |
| - bufioFlushWriter.Write |
| - cancelTimerBody.Close |
| - cancelTimerBody.Read |
| - checkConnErrorWriter.Write |
| - chunkWriter.Write |
| - connReader.Read |
| - connectMethodKey.String |
| - expectContinueReader.Close |
| - expectContinueReader.Read |
| - extraHeader.Write |
| - fileHandler.ServeHTTP |
| - fileTransport.RoundTrip |
| - globalOptionsHandler.ServeHTTP |
| - gzipReader.Close |
| - gzipReader.Read |
| - http1ClientConn.Close |
| - http1ClientConn.RoundTrip |
| - http2ClientConn.Close |
| - http2ClientConn.Ping |
| - http2ClientConn.RoundTrip |
| - http2ClientConn.Shutdown |
| - http2ConnectionError.Error |
| - http2ErrCode.String |
| - http2FrameHeader.String |
| - http2FrameType.String |
| - http2FrameWriteRequest.String |
| - http2Framer.ReadFrame |
| - http2Framer.ReadFrameForHeader |
| - http2Framer.ReadFrameHeader |
| - http2Framer.WriteContinuation |
| - http2Framer.WriteData |
| - http2Framer.WriteDataPadded |
| - http2Framer.WriteGoAway |
| - http2Framer.WriteHeaders |
| - http2Framer.WritePing |
| - http2Framer.WritePriority |
| - http2Framer.WritePushPromise |
| - http2Framer.WriteRSTStream |
| - http2Framer.WriteRawFrame |
| - http2Framer.WriteSettings |
| - http2Framer.WriteSettingsAck |
| - http2Framer.WriteWindowUpdate |
| - http2GoAwayError.Error |
| - http2Server.ServeConn |
| - http2Setting.String |
| - http2SettingID.String |
| - http2SettingsFrame.ForeachSetting |
| - http2StreamError.Error |
| - http2Transport.CloseIdleConnections |
| - http2Transport.NewClientConn |
| - http2Transport.RoundTrip |
| - http2Transport.RoundTripOpt |
| - http2bufferedWriter.Flush |
| - http2bufferedWriter.Write |
| - http2bufferedWriterTimeoutWriter.Write |
| - http2chunkWriter.Write |
| - http2clientConnPool.GetClientConn |
| - http2connError.Error |
| - http2dataBuffer.Read |
| - http2duplicatePseudoHeaderError.Error |
| - http2gzipReader.Close |
| - http2gzipReader.Read |
| - http2headerFieldNameError.Error |
| - http2headerFieldValueError.Error |
| - http2netHTTPClientConn.Close |
| - http2netHTTPClientConn.RoundTrip |
| - http2noDialClientConnPool.GetClientConn |
| - http2noDialH2RoundTripper.NewClientConn |
| - http2noDialH2RoundTripper.RoundTrip |
| - http2pipe.Read |
| - http2priorityWriteSchedulerRFC7540.CloseStream |
| - http2priorityWriteSchedulerRFC7540.OpenStream |
| - http2priorityWriteSchedulerRFC9218.OpenStream |
| - http2pseudoHeaderError.Error |
| - http2requestBody.Close |
| - http2requestBody.Read |
| - http2responseWriter.Flush |
| - http2responseWriter.FlushError |
| - http2responseWriter.Push |
| - http2responseWriter.SetReadDeadline |
| - http2responseWriter.SetWriteDeadline |
| - http2responseWriter.Write |
| - http2responseWriter.WriteHeader |
| - http2responseWriter.WriteString |
| - http2roundRobinWriteScheduler.OpenStream |
| - http2serverConn.CloseConn |
| - http2serverConn.Flush |
| - http2stickyErrWriter.Write |
| - http2transportResponseBody.Close |
| - http2transportResponseBody.Read |
| - http2unencryptedTransport.RoundTrip |
| - http2writeData.String |
| - initALPNRequest.ServeHTTP |
| - loggingConn.Close |
| - loggingConn.Read |
| - loggingConn.Write |
| - maxBytesReader.Close |
| - maxBytesReader.Read |
| - onceCloseListener.Close |
| - persistConn.Read |
| - persistConnWriter.ReadFrom |
| - persistConnWriter.Write |
| - populateResponse.Write |
| - populateResponse.WriteHeader |
| - readTrackingBody.Close |
| - readTrackingBody.Read |
| - readWriteCloserBody.CloseWrite |
| - readWriteCloserBody.Read |
| - redirectHandler.ServeHTTP |
| - response.Flush |
| - response.FlushError |
| - response.Hijack |
| - response.ReadFrom |
| - response.Write |
| - response.WriteHeader |
| - response.WriteString |
| - serverHandler.ServeHTTP |
| - socksDialer.DialWithConn |
| - socksUsernamePassword.Authenticate |
| - stringWriter.WriteString |
| - timeoutHandler.ServeHTTP |
| - timeoutWriter.Write |
| - timeoutWriter.WriteHeader |
| - transportReadFromServerError.Error |
| - unencryptedHTTP2Request.ServeHTTP |
| - module: std |
| versions: |
| - introduced: 1.27.0-0 |
| - fixed: 1.27.2 |
| vulnerable_at: 1.27.1 |
| packages: |
| - package: net/http/internal/http2 |
| symbols: |
| - serverConn.processSetting |
| - serverConn.startFrameWrite |
| derived_symbols: |
| - ClientConn.Close |
| - ClientConn.Ping |
| - ClientConn.RoundTrip |
| - ClientConn.Shutdown |
| - Framer.ReadFrame |
| - Framer.ReadFrameForHeader |
| - Framer.ReadFrameHeader |
| - Framer.WriteContinuation |
| - Framer.WriteData |
| - Framer.WriteDataPadded |
| - Framer.WriteGoAway |
| - Framer.WriteHeaders |
| - Framer.WritePing |
| - Framer.WritePriority |
| - Framer.WritePriorityUpdate |
| - Framer.WritePushPromise |
| - Framer.WriteRSTStream |
| - Framer.WriteRawFrame |
| - Framer.WriteSettings |
| - Framer.WriteSettingsAck |
| - Framer.WriteWindowUpdate |
| - NetHTTPClientConn.Close |
| - NetHTTPClientConn.Ping |
| - NetHTTPClientConn.RoundTrip |
| - ReadFrameHeader |
| - Server.GracefulShutdown |
| - Server.ServeConn |
| - SettingsFrame.ForeachSetting |
| - Transport.AddConn |
| - Transport.CloseIdleConnections |
| - Transport.NewClientConn |
| - Transport.RoundTrip |
| - Transport.RoundTripOpt |
| - bufferedWriter.Flush |
| - bufferedWriter.Write |
| - bufferedWriterTimeoutWriter.Write |
| - chunkWriter.Write |
| - clientConnPool.GetClientConn |
| - gzipReader.Close |
| - gzipReader.Read |
| - noDialClientConnPool.GetClientConn |
| - requestBody.Close |
| - responseWriter.Flush |
| - responseWriter.FlushError |
| - responseWriter.Push |
| - responseWriter.Write |
| - responseWriter.WriteHeader |
| - responseWriter.WriteString |
| - serve400Handler.ServeHTTP |
| - serverConn.Flush |
| - stickyErrWriter.Write |
| - transportResponseBody.Close |
| - transportResponseBody.Read |
| - module: golang.org/x/net |
| versions: |
| - fixed: 0.60.0 |
| vulnerable_at: 0.59.0 |
| packages: |
| - package: golang.org/x/net/http2 |
| symbols: |
| - serverConn.processSetting |
| - serverConn.startFrameWrite |
| derived_symbols: |
| - ClientConn.Close |
| - ClientConn.Ping |
| - ClientConn.RoundTrip |
| - ClientConn.Shutdown |
| - ConfigureServer |
| - ConfigureTransport |
| - ConfigureTransports |
| - ConnectionError.Error |
| - ErrCode.String |
| - FrameHeader.String |
| - FrameType.String |
| - FrameWriteRequest.String |
| - Framer.ReadFrame |
| - Framer.ReadFrameForHeader |
| - Framer.ReadFrameHeader |
| - Framer.WriteContinuation |
| - Framer.WriteData |
| - Framer.WriteDataPadded |
| - Framer.WriteGoAway |
| - Framer.WriteHeaders |
| - Framer.WritePing |
| - Framer.WritePriority |
| - Framer.WritePriorityUpdate |
| - Framer.WritePushPromise |
| - Framer.WriteRSTStream |
| - Framer.WriteRawFrame |
| - Framer.WriteSettings |
| - Framer.WriteSettingsAck |
| - Framer.WriteWindowUpdate |
| - GoAwayError.Error |
| - ReadFrameHeader |
| - Server.ServeConn |
| - Setting.String |
| - SettingID.String |
| - SettingsFrame.ForeachSetting |
| - StreamError.Error |
| - Transport.CloseIdleConnections |
| - Transport.NewClientConn |
| - Transport.RoundTrip |
| - Transport.RoundTripOpt |
| - bufferedWriter.Flush |
| - bufferedWriter.Write |
| - bufferedWriterTimeoutWriter.Write |
| - chunkWriter.Write |
| - clientConnPool.GetClientConn |
| - connError.Error |
| - dataBuffer.Read |
| - duplicatePseudoHeaderError.Error |
| - gzipReader.Close |
| - gzipReader.Read |
| - headerFieldNameError.Error |
| - headerFieldValueError.Error |
| - netHTTPClientConn.Close |
| - netHTTPClientConn.RoundTrip |
| - noDialClientConnPool.GetClientConn |
| - noDialH2RoundTripper.NewClientConn |
| - noDialH2RoundTripper.RoundTrip |
| - pipe.Read |
| - priorityWriteSchedulerRFC7540.CloseStream |
| - priorityWriteSchedulerRFC7540.OpenStream |
| - priorityWriteSchedulerRFC9218.OpenStream |
| - pseudoHeaderError.Error |
| - requestBody.Close |
| - requestBody.Read |
| - responseWriter.Flush |
| - responseWriter.FlushError |
| - responseWriter.Push |
| - responseWriter.SetReadDeadline |
| - responseWriter.SetWriteDeadline |
| - responseWriter.Write |
| - responseWriter.WriteHeader |
| - responseWriter.WriteString |
| - roundRobinWriteScheduler.OpenStream |
| - serverConn.CloseConn |
| - serverConn.Flush |
| - stickyErrWriter.Write |
| - transportResponseBody.Close |
| - transportResponseBody.Read |
| - unencryptedTransport.RoundTrip |
| - writeData.String |
| summary: HTTP/2 server crash due to HPACK encoder race in net/http |
| description: |- |
| HTTP/2 servers could end up crashing due to inadvertently |
| modifying its HPACK encoder concurrently. This happens because the |
| server modifies the HPACK encoder from two goroutines without |
| synchronization: one uses the encoder to encode a HEADERS frame as part |
| of a response sent to a client and the other modifies the encoder's |
| table size when handling a SETTINGS frame containing |
| SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can |
| repeatedly send a request while changing the header table size to crash |
| the server. |
| credits: |
| - RyotaK (https://ryotak.net) of GMO Flatt Security Inc. |
| references: |
| - fix: https://go.dev/cl/847188 |
| - fix: https://go.dev/cl/847313 |
| - report: https://go.dev/issue/81867 |
| - web: https://groups.google.com/g/golang-announce/c/U2fTuyDJznI |
| - web: https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs |
| cve_metadata: |
| id: CVE-2026-97032 |
| cwe: 'CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (''Race Condition'')' |
| source: |
| id: go-security-team |
| created: 2026-10-08T00:00:00Z |
| review_status: REVIEWED |
