Threats affecting pkg:golang/net/http/internal/http2

CVE-2026-78660 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP requests, leading to HTTP response smuggling. The issue arises because the HTTP/2 implementation in net/http is lax about malformed framing-related headers, which can be forwarded to HTTP/1 clients when acting as a reverse proxy. If the HTTP/1 client also does not strictly validate these headers, response smuggling can occur.

CVE-2026-78659 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption through the handling of "Trailer" headers in HTTP/2 servers. A malicious client can send a "Trailer" header declaring many fields, causing excessive memory allocation by the server. This bypasses existing limits on header size and count, leading to potential denial-of-service conditions. The issue does not affect HTTP/1 servers due to different header handling and lack of multiplexing. No known exploits are reported in the wild. Affected versions include multiple pre-1.26.9 and pre-1.27.2 releases, as well as versions before 0.60.0. No patch or official fix information is provided in the input data.

CVE-2026-78669 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption (amplification) via HTTP/2 where a malicious peer can cause excessive CPU usage by opening many streams and sending numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. This can impact both clients and servers using the affected versions of the net/http package.

CVE-2026-78663 is a critical vulnerability in the Go standard library net/http package affecting HTTP/2 servers. It allows a malicious client to bypass the configured connection-level flow control limit by causing the server to refund flow control credits twice for the same data. This occurs when a client resets a stream and the request handler subsequently reads buffered data, resulting in double refunding of connection-level flow control. Although total buffered data remains limited by concurrent stream limits and stream-level flow control, this flaw can lead to denial of service or resource exhaustion.

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".