CVE-2026-78663: CWE-675: Multiple Operations on Resource in Single-Operation Context in Go standard library net/http

The vulnerability arises from the HTTP/2 server in Go's net/http package refunding connection-level flow control credits twice for the same data: once upon client stream reset and again when the request handler reads buffered data. This flaw enables a malicious client to circumvent the MaxReceiveBufferPerConnection limit, potentially allowing more data to be buffered at the connection level than intended. However, the total buffered data is still limited by the concurrent stream limit and stream-level flow control mechanisms. The affected versions include all Go versions prior to 1.26.9, versions from 1.27.0-0 up to but excluding 1.27.2, and all versions prior to 0.60.0.

A malicious client can exploit this vulnerability to bypass the connection-level flow control limit, potentially leading to resource exhaustion or degraded service on the server due to excessive buffered data. However, the impact is mitigated by other flow control limits such as the concurrent stream limit and stream-level flow control, which still restrict total buffered data.

No patch links or vendor advisory details are provided, and patch status is not confirmed. Users should check the official Go project advisories for updates and apply any available fixes promptly. Until a fix is confirmed, monitoring and limiting client behavior may help mitigate risk.