CVE-2026-97032: 
Go Analisi e mitigazione delle vulnerabilità

CVE-2026-97032 is a Denial of Service vulnerability in Go's HTTP/2 implementation caused by a race condition in the HPACK encoder. HTTP/2 servers can crash when the HPACK encoder is concurrently modified by two unsynchronized goroutines: one encoding HEADERS frames for responses and another modifying the encoder's table size in response to a client-sent SETTINGS_HEADER_TABLE_SIZE value. Affected components include golang.org/x/net/http2 before version 0.60.0, Go standard library net/http before 1.26.9, and net/http/internal/http2 in versions 1.27.0-0 through 1.27.2. The vulnerability was published on October 8, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362 / CWE-366) in Go's HTTP/2 HPACK encoder, which is accessed concurrently from two goroutines without proper synchronization. The first goroutine uses the encoder to serialize HEADERS frames when sending HTTP/2 responses; the second goroutine modifies the encoder's dynamic table size when processing a client-initiated SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE. Because no mutex or other synchronization primitive guards these concurrent accesses, a malicious client can trigger a data race by repeatedly sending HTTP/2 requests while simultaneously adjusting the header table size, ultimately causing the server process to crash. The attack requires no authentication and no user interaction, making it fully automatable over the network (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a crash of the HTTP/2 server process, causing a complete loss of availability for any service relying on the affected Go HTTP/2 implementation. There is no impact on confidentiality or data integrity — the vulnerability is purely a Denial of Service condition. Affected deployments include any Go-based HTTP/2 server using net/http, net/http/internal/http2, or golang.org/x/net/http2 in vulnerable versions, as well as downstream products such as Microsoft Azure Linux packages (jx, multus, skopeo, telegraf), Docker, rclone, and other Go ecosystem software (Red Hat Advisory, Microsoft MSRC).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (Red Hat Advisory). The NVD SSVC assessment classifies the attack as automatable with partial technical impact, and exploitation requires no privileges or user interaction. The EPSS score is approximately 0.18%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate an internet-facing HTTP/2 server built with a vulnerable version of Go's net/http, net/http/internal/http2, or golang.org/x/net/http2 (e.g., using banner scanning or service fingerprinting tools such as Nmap or Shodan).
2. Establish HTTP/2 connection: Open an HTTP/2 connection to the target server using a tool or custom client that supports raw HTTP/2 framing (e.g., h2c, curl --http2, or a custom Go/Python HTTP/2 client).
3. Send concurrent requests and SETTINGS frames: From the same connection, simultaneously send HTTP/2 SETTINGS frames with varying SETTINGS_HEADER_TABLE_SIZE values while also sending HEADERS frames (normal HTTP requests). This triggers the race condition between the goroutine encoding response headers and the goroutine updating the HPACK table size.
4. Repeat to trigger crash: Rapidly repeat step 3 in a loop. The unsynchronized concurrent access to the HPACK encoder will eventually cause a data race, crashing the server process and resulting in denial of service (Red Hat Bugzilla, Red Hat Advisory).

• Network: High-frequency HTTP/2 connections from a single client IP sending both SETTINGS frames (with rapidly changing SETTINGS_HEADER_TABLE_SIZE) and HEADERS frames concurrently; unusual volume of HTTP/2 SETTINGS frames in network captures.
• Logs: Sudden HTTP/2 server process crashes or panics in application logs; Go runtime panic messages referencing HPACK encoder or concurrent map/slice access; repeated server restarts in a short time window.
• Process: Unexpected termination of Go HTTP/2 server processes; crash dump files (core dumps) generated by the Go runtime in the server's working directory.

Upgrade to a patched version immediately: Go standard library net/http should be updated to 1.26.9 or later; net/http/internal/http2 should be updated to 1.27.2 or later (for Go 1.27.x users); and golang.org/x/net/http2 should be updated to 0.60.0 or later. Downstream products (Docker, rclone, Microsoft Azure Linux packages, etc.) should be updated to versions that incorporate these Go fixes. As a temporary workaround, implement rate limiting or connection throttling on HTTP/2 connections to reduce the frequency of SETTINGS frame changes from individual clients, and monitor server logs for unexpected crashes (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was part of a broader Go security release that addressed multiple flaws, noted in community channels including the golang-announce mailing list and covered by Linux security outlets such as LinuxSecurity.com. BleepingComputer referenced it in the context of Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws. SUSE issued security advisories (SUSE-SU-2026:4625-1 and SUSE-SU-2026:4629-1) for affected packages, and Mageia published a corresponding advisory. Social media activity was limited, with automated CVE tracking accounts on Bluesky and Mastodon noting the disclosure.