This vulnerability (CWE-770) in the Go standard library's net/http package arises because when unencrypted HTTP/2 is enabled, the server reads a few bytes from each new connection to check for the HTTP/2 client preface. However, the ReadHeaderTimeout is not enforced during this read operation, allowing an attacker to open many connections that consume server resources without timeout enforcement. This lack of throttling can lead to resource exhaustion and denial of service conditions.

The vulnerability can be exploited to cause denial of service by exhausting server resources, as the server does not apply the expected ReadHeaderTimeout when reading the HTTP/2 client preface bytes. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling unencrypted HTTP/2 support or implementing external connection rate limiting to mitigate resource exhaustion risks.