CVE-2026-78659: Go Standard Library Net/http

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Affected products

• Go Standard Library Net/http: before 1.26.9 (fixed in 1.26.9)
• Go Standard Library net/http/internal/http2: from 1.27.0-0, before 1.27.2 (fixed in 1.27.2)
• Golang.org/x/net golang.org/x/net/http2: before 0.60.0 (fixed in 0.60.0)

Published 2026-10-08. Last modified 2026-10-09.