CVE-2026-56853: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-56853 is a Denial of Service vulnerability in the Go standard library's net/http package affecting servers configured to support unencrypted HTTP/2. When such a server reads the initial bytes from a new connection to detect the HTTP/2 client preface, the ReadHeaderTimeout setting is not applied, leaving connections open indefinitely. This allows unauthenticated remote attackers to exhaust server connection resources via a slowloris-style attack. Affected versions include Go net/http before 1.25.13, 1.26.0–1.26.5, and 1.27.0-0–1.27.0-rc.2. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). When a Go HTTP server is configured for unencrypted (cleartext) HTTP/2, it reads a small number of bytes from each new TCP connection to determine whether the connection begins with the HTTP/2 client preface string. During this read phase, the server fails to enforce the configured ReadHeaderTimeout, meaning a connection that never sends (or slowly sends) the preface bytes will be held open without any timeout enforcement. An unauthenticated attacker can open many such connections and deliberately withhold or delay the preface bytes, causing the server to accumulate idle connections indefinitely. The issue is tracked upstream at Go Issue 80205 and fixed via CL 795540 (Github Advisory, Go Vuln DB).

Successful exploitation results in a Denial of Service against the affected Go HTTP/2 server, exhausting available connection resources and preventing legitimate users from establishing new connections. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Services built on Go's net/http that explicitly enable unencrypted HTTP/2 (h2c) are at risk; HTTPS-only deployments are not affected (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is automatable (no user interaction or authentication required) and exploitable from the network with low complexity. The EPSS score is approximately 0.22% (0.59% per GitHub Advisory), placing it in the lower-to-mid range of exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Go Vuln DB).

1. Reconnaissance: Identify internet-facing services built with Go's net/http that are configured to accept unencrypted HTTP/2 (h2c) connections, using tools like Shodan or direct probing with curl --http2-prior-knowledge.
2. Establish connections: Open a large number of TCP connections to the target server's HTTP/2 port.
3. Withhold client preface: After establishing each TCP connection, deliberately delay or never send the HTTP/2 client preface bytes (PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n).
4. Hold connections open: Because ReadHeaderTimeout is not enforced during the preface-reading phase, the server holds each connection open indefinitely, consuming file descriptors and connection slots.
5. Exhaust resources: Repeat until the server's connection limit is reached, causing new legitimate connection attempts to be refused or dropped, resulting in a Denial of Service (Github Advisory, Go Vuln DB).

• Network: Large number of TCP connections to the HTTP/2 port in a SYN_RECV or ESTABLISHED state that never progress to sending data; connections from many source IPs or a single IP holding many idle connections.
• Logs: Go HTTP server logs showing a high volume of new connections with no corresponding request completions or timeouts; absence of ReadHeaderTimeout expiry log entries despite long-lived connections.
• Process: Elevated open file descriptor count for the Go server process (/proc/<pid>/fd); system metrics showing connection table exhaustion (ss -s or netstat showing high ESTABLISHED count with no data transfer).
• System: Alerts from load balancers or reverse proxies indicating backend connection pool exhaustion or upstream connection refused errors.

Upgrade to Go 1.25.13, 1.26.6, or 1.27.0-rc.3 or later, which apply the ReadHeaderTimeout correctly during the HTTP/2 client preface read phase (Go Vuln DB, Github Advisory). As an interim workaround, disable unencrypted HTTP/2 (h2c) support and serve HTTP/2 only over TLS (HTTPS), which is not affected by this issue. Alternatively, implement connection-level timeouts at the network perimeter (e.g., load balancer or firewall idle connection timeout) to terminate stale connections before they exhaust server resources. Red Hat has issued an advisory (RHSA-2026:54836) for affected Red Hat products, and SUSE has released SUSE-SU-2026:3640-1 (Red Hat Bugzilla).

The Go team disclosed the vulnerability via the golang-announce mailing list and published a fix through the standard Go security release process (golang-announce). The issue was also reported to the oss-security mailing list. Downstream Linux distributions including Red Hat, SUSE, openSUSE, and Debian have issued or are tracking security advisories. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking.