CVE-2026-97032: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Go standard library net/http
Description
A race condition vulnerability exists in the Go standard library net/http package's HTTP/2 server implementation. The issue arises from concurrent unsynchronized access to the HPACK encoder by two goroutines: one encoding HEADERS frames and another modifying the header table size from SETTINGS frames. A malicious client can exploit this by repeatedly sending requests while changing the header table size, causing the server to crash.
Affected software
Go standard library
net/http
Go standard library
net/http/internal/http2
golang.org/x/net
golang.org/x/net/http2
pkg:golang/net/http/internal/http2pkg:golang/golang.org/x/net/http2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-97032 describes a race condition (CWE-362) in the Go standard library's net/http package affecting HTTP/2 servers. The vulnerability occurs because the HPACK encoder is accessed concurrently without proper synchronization by two goroutines: one encoding response HEADERS frames and another adjusting the encoder's table size upon receiving SETTINGS_HEADER_TABLE_SIZE from a client. This concurrent modification can lead to server crashes when exploited by a malicious client sending repeated requests with varying header table sizes.
Potential Impact
The vulnerability can cause HTTP/2 servers using the affected Go net/http versions to crash, resulting in denial of service. There is no indication of code execution or data leakage. The impact is limited to service availability disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, consider limiting or filtering suspicious HTTP/2 traffic that manipulates SETTINGS_HEADER_TABLE_SIZE or rate-limiting client requests to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Go
- Date Reserved
- 2026-09-23T23:03:58.333Z
- State
- PUBLISHED
Threat ID: 6ac821662cdf04f65641721c
Added to database: 10/08/2026, 23:04:06 UTC
Last enriched: 10/08/2026, 23:18:48 UTC
Last updated: 10/08/2026, 23:19:11 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.