Golang.org/x/net golang.org/x/net/http2 vulnerabilities

7 CVEs affecting Golang.org/x/net golang.org/x/net/http2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97032, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-45288, published 2024-04-04. High severity, CVSS 7.5. EPSS: 92% chance of exploitation in the next 30 days. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all…
CVE-2026-27141, published 2026-02-26. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
CVE-2026-78663, published 2026-10-08. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a…
CVE-2026-78659, published 2026-10-08. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each…
CVE-2026-78669, published 2026-10-08. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing…
CVE-2026-97032, published 2026-10-08. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without…
CVE-2026-78660, published 2026-10-08. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our…