CVE-2026-78660High· 7.5▾ TwilightHistorically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
— → 7.5
none → high
0.2% → 0.4%
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
stdlib < 1.26.9stdlib >= 1.27.0-0, < 1.27.2golang.org/x/net < 0.60.0Patched in:
stdlib 1.26.9stdlib 1.27.2golang.org/x/net 0.60.0Source: https://osv.dev/vulnerability/GO-2026-6610
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94439High· 7.5When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection
CVE-2026-56866High· 7.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers
CVE-2026-97031High· 7.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references
CVE-2026-97032High· 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97030Medium· 6.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-94448Medium· 6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression