CVE-2026-78659: 
Go vulnerability analysis and mitigation

CVE-2026-78659 is a Denial of Service vulnerability in Go's net/http and net/http/internal/http2 standard library packages caused by asymmetric resource consumption (CWE-405) when processing HTTP/2 Trailer headers. A malicious client can send a Trailer header declaring a large number of fields, forcing the server to allocate excessive memory for the Request.Trailer map while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. Affected versions include Go net/http before 1.26.9, net/http/internal/http2 versions 1.27.0-0 through before 1.27.2, and golang.org/x/net/http2 before 0.60.0. The vulnerability was published on October 8, 2026, with patches released October 11, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Microsoft MSRC, Feedly).

The root cause is asymmetric resource consumption (CWE-405) in Go's HTTP/2 server implementation. When a client sends a Trailer header, the server pre-allocates a Request.Trailer map with entries for each declared trailer field before any trailer data is actually received. Because each map entry incurs memory overhead and the number of declared fields is not bounded by the existing Server.MaxHeaderValueCount or Server.MaxHeaderBytes limits (which apply differently to HTTP/2), an attacker can declare an arbitrarily large number of trailer fields in a single request, causing disproportionate memory allocation. HTTP/1 servers are not affected because they do not support multiplexing many requests over a single TCP connection and apply MaxHeaderBytes differently. The vulnerability is tracked upstream as Go issue #81857 and fixed via code changes CL/847185 and CL/847314 (Feedly, Go Issue).

Successful exploitation results in memory exhaustion on the targeted HTTP/2 server, leading to service unavailability (Denial of Service). The attack requires no authentication and no user interaction, making it trivially automatable against any internet-facing Go HTTP/2 server running a vulnerable version. There is no confidentiality or integrity impact; the sole consequence is availability loss, which can affect any application or service built on Go's net/http or golang.org/x/net/http2 packages, including container infrastructure components such as Skopeo, Multus, Telegraf, and jx on Azure Linux 3 (Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.227%, indicating a low current probability of exploitation. However, NVD's SSVC assessment notes the attack is automatable, which increases the risk for unpatched internet-facing HTTP/2 services.

1. Reconnaissance: Identify internet-facing HTTP/2 servers built with Go's net/http or golang.org/x/net/http2 packages running versions prior to 1.26.9 / 1.27.2 / x/net 0.60.0, using tools like Shodan, Censys, or HTTP fingerprinting.
2. Craft malicious request: Construct an HTTP/2 request that includes a Trailer header listing an arbitrarily large number of field names (e.g., thousands of unique trailer field names) without necessarily sending the actual trailer data.
3. Send request: Transmit the crafted HTTP/2 request to the target server. Because HTTP/2 supports multiplexing, multiple such requests can be sent concurrently over a single TCP connection to amplify the effect.
4. Trigger memory exhaustion: The server allocates a Request.Trailer map entry for each declared trailer field, consuming memory proportional to the number of declared fields. Repeating this across multiple streams or connections exhausts available server memory.
5. Achieve DoS: The server becomes unresponsive or crashes due to out-of-memory conditions, resulting in denial of service for legitimate users (Feedly, Go CL).

• Network: Unusual HTTP/2 requests containing Trailer headers with an abnormally large number of declared field names; high volume of concurrent HTTP/2 streams from a single source IP targeting the same server.
• Logs: Server access logs showing repeated requests with oversized or anomalous Trailer header values; application logs indicating out-of-memory errors or Go runtime panics related to map allocation.
• Process/System: Rapid increase in memory consumption by the Go HTTP server process without a corresponding increase in legitimate traffic; OOM killer events in system logs (dmesg or /var/log/syslog) terminating the Go server process.

Update Go to version 1.26.9 or 1.27.2 (for the 1.27.x branch), or update golang.org/x/net/http2 to version 0.60.0 or later. Microsoft has released patches for affected Azure Linux 3 packages (skopeo, multus, telegraf, jx). As temporary mitigations while patching, consider implementing connection-level rate limiting, request timeouts, and restricting access to HTTP/2 endpoints from untrusted networks. HTTP/1 servers are not affected and require no action (Microsoft MSRC, Go Advisory, SUSE Advisory).

The vulnerability was included in Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws, drawing broad media coverage (BleepingComputer). SUSE issued security updates for affected Go packages shortly after disclosure. The Docker project released Docker v29.9.0 incorporating the fix, and rclone published an updated changelog referencing the patch. The Go security team announced the releases via the golang-announce mailing list, and the issue was disclosed on oss-security (oss-sec).