Search: CVE-2026-78663

CVE-2026-78663 is a critical vulnerability in the Go standard library net/http package affecting HTTP/2 servers. It allows a malicious client to bypass the configured connection-level flow control limit by causing the server to refund flow control credits twice for the same data. This occurs when a client resets a stream and the request handler subsequently reads buffered data, resulting in double refunding of connection-level flow control. Although total buffered data remains limited by concurrent stream limits and stream-level flow control, this flaw can lead to denial of service or resource exhaustion.