CVE-2026-78663

CriticalCVSS 9.1/10Last modified Oct 9, 2026

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-675

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Go standard librarynet/http< 1.26.9
Go standard librarynet/http/internal/http2>= 1.27.0-0, < 1.27.2
golang.org/x/netgolang.org/x/net/http2< 0.60.0

References

Timeline

Published
Oct 8, 2026
Last modified
Oct 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-786677.5When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessCVE-2026-786697.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending maCVE-2026-78677.8A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-userCVE-2026-786737.5IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.CVE-2026-786757.8GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by incluCVE-2026-786769.8GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values CVE-2026-786777.5GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outsiCVE-2026-786786.5GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S optionCVE-2026-786796.5GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypassCVE-2026-78688.8IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves adCVE-2026-786807.8NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AligneCVE-2026-786817.5NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. A