Search: CVE-2026-56853

CVE-2026-56853 is a high-severity vulnerability in the Go standard library net/http package. It occurs when a server supports unencrypted HTTP/2 and reads initial bytes from new connections to detect the HTTP/2 client preface. During this process, the ReadHeaderTimeout setting is not applied as expected, leading to allocation of resources without proper limits or throttling. This can cause denial of service by exhausting server resources.