--- id: CVE-2026-56853 aliases: - GO-2026-6089 - BIT-golang-2026-56853 title: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http summary: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' vendor: stdlib product: stdlib ecosystem: go affected: - 'stdlib >= 1.27.0-0, < 1.27.0-rc.3' patched: - stdlib 1.27.0-rc.3 published: '2026-08-13' updated: '2026-10-07' sourceUpdated: '2026-10-07T10:41:45.889550693Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6089' references: - url: 'https://go.dev/issue/80205' - url: 'https://go.dev/cl/795540' - url: 'https://groups.google.com/g/golang-announce/c/94pEornpRlI' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56853.json - url: 'https://access.redhat.com/security/cve/CVE-2026-56853' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515827' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56853' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56853' - url: 'https://pkg.go.dev/vuln/GO-2026-6089' - url: 'https://access.redhat.com/errata/RHSA-2026:71113' - url: 'https://access.redhat.com/errata/RHSA-2026:71112' - url: 'https://access.redhat.com/errata/RHSA-2026:68334' - url: 'https://access.redhat.com/errata/RHSA-2026:68335' - url: 'https://access.redhat.com/errata/RHSA-2026:71114' - url: 'https://access.redhat.com/errata/RHSA-2026:65918' - url: 'https://access.redhat.com/errata/RHSA-2026:61882' - url: 'https://access.redhat.com/errata/RHSA-2026:67517' - url: 'https://access.redhat.com/errata/RHSA-2026:66459' - url: 'https://access.redhat.com/errata/RHSA-2026:65335' - url: 'https://access.redhat.com/errata/RHSA-2026:67974' - url: 'https://access.redhat.com/errata/RHSA-2026:66327' - url: 'https://access.redhat.com/errata/RHSA-2026:70103' - url: 'https://access.redhat.com/errata/RHSA-2026:63332' - url: 'https://access.redhat.com/errata/RHSA-2026:64777' - url: 'https://access.redhat.com/errata/RHSA-2026:62578' - url: 'https://access.redhat.com/errata/RHSA-2026:60306' - url: 'https://access.redhat.com/errata/RHSA-2026:63022' - url: 'https://access.redhat.com/errata/RHSA-2026:63119' - url: 'https://access.redhat.com/errata/RHSA-2026:65534' - url: 'https://access.redhat.com/errata/RHSA-2026:62631' - url: 'https://access.redhat.com/errata/RHSA-2026:65116' - url: 'https://access.redhat.com/errata/RHSA-2026:65895' - url: 'https://access.redhat.com/errata/RHSA-2026:70201' - url: 'https://access.redhat.com/errata/RHSA-2026:67464' - url: 'https://access.redhat.com/errata/RHSA-2026:64818' - url: 'https://access.redhat.com/errata/RHSA-2026:63163' - url: 'https://access.redhat.com/errata/RHSA-2026:60305' - url: 'https://access.redhat.com/errata/RHSA-2026:62407' - url: 'https://access.redhat.com/errata/RHSA-2026:63124' - url: 'https://access.redhat.com/errata/RHSA-2026:66016' - url: 'https://access.redhat.com/errata/RHSA-2026:64786' - url: 'https://access.redhat.com/errata/RHSA-2026:62602' - url: 'https://access.redhat.com/errata/RHSA-2026:65359' - url: 'https://access.redhat.com/errata/RHSA-2026:62754' - url: 'https://access.redhat.com/errata/RHSA-2026:62405' tags: - osv - go - csaf - vex - red-hat epss: 0.00568 epssPercentile: 0.46877 cvssSource: vendor cwe: - CWE-770 ingestedAt: '2026-08-14T19:18:46.559Z' --- ## Overview When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. ## Affected packages - `stdlib >= 1.27.0-0, < 1.27.0-rc.3` ## Remediation Upgrade to a patched release: - `stdlib 1.27.0-rc.3` ## Vendor advisories - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:71112** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71112) - **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334) - **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335) - **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114) - **RHSA-2026:65918** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65918) - **RHSA-2026:61882** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61882) - **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517) - **RHSA-2026:66459** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66459) - **RHSA-2026:65335** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65335) - **RHSA-2026:67974** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67974) - **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Deployment Validation Operator, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, … · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56853.json) - **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327) - **RHSA-2026:70103** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70103) - **RHSA-2026:63332** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63332) - **RHSA-2026:64777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64777) - **RHSA-2026:62578** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62578) - **RHSA-2026:60306** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60306) - **RHSA-2026:63022** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63022) - **RHSA-2026:63119** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63119) - **RHSA-2026:65534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65534) - **RHSA-2026:62631** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62631) - **RHSA-2026:65116** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65116)