CVE-2026-78669: CWE-405: Asymmetric Resource Consumption (Amplification) in Go standard library net/http

This vulnerability involves an asymmetric resource consumption (amplification) issue in the Go standard library's net/http package. An attacker using HTTP/2 can open a large number of streams and send many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values, causing excessive CPU consumption on the client or server side. The affected versions include all Go versions before 1.26.9, versions from 1.27.0-0 up to but not including 1.27.2, and all versions before 0.60.0. No CVSS score is provided, and no known exploits are reported in the wild. No patch or remediation information is available in the provided data.

The impact is excessive CPU consumption on the affected client or server running the vulnerable net/http package, which can degrade performance and potentially lead to denial of service conditions due to resource exhaustion. There is no indication of code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the number of concurrent HTTP/2 streams and monitoring for unusual SETTINGS frame activity if possible. No official fix or workaround is documented in the provided data.