CVE-2026-78660: 
Go vulnerability analysis and mitigation

CVE-2026-78660 is an HTTP response smuggling vulnerability in the Go standard library's HTTP/2 implementation, classified under CWE-444 (Inconsistent Interpretation of HTTP Requests). The flaw arises because Go's HTTP/2 implementation historically permitted malformed framing-related headers, which can then be forwarded to HTTP/1 clients when the Go application acts as a reverse proxy, enabling response smuggling if the downstream client is also non-strict. Affected components include net/http (Go versions before 1.26.9), net/http/internal/http2 (Go 1.27.0-0 through before 1.27.2), and golang.org/x/net/http2 (before 0.60.0). Several Microsoft Azure Linux 3 packages (telegraf, cri-tools, cf-cli, azcopy, multus, skopeo) are also listed as affected. The vulnerability was published on October 8, 2026, with patches released October 11, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Go Vuln DB, Microsoft MSRC).

The root cause is CWE-444 — Go's HTTP/2 implementation did not strictly reject malformed framing-related headers (e.g., headers that would be meaningful in HTTP/1 framing context such as Transfer-Encoding or Content-Length), reasoning that such headers cannot affect HTTP/2 framing itself. However, when Go acts as a reverse proxy bridging HTTP/2 backends to HTTP/1 clients, these malformed headers are forwarded downstream. If the HTTP/1 client also lacks strict header validation, it may misinterpret the response boundaries, resulting in response smuggling (CAPEC-33). The attack requires no authentication, no user interaction, and is network-accessible with low complexity, making it automatable. Relevant upstream references include the Go issue tracker and code changes at go.dev/issue/81115, go.dev/cl/835145, and go.dev/cl/836385 (Go Vuln DB, OSS-Sec).

Successful exploitation allows an unauthenticated network attacker to perform HTTP response smuggling, enabling content injection into responses received by non-strict HTTP/1 clients. This primarily affects integrity (CVSS integrity impact: High), with no direct confidentiality or availability impact per the CVSS scoring. Practical consequences include bypassing security controls (e.g., injecting headers to circumvent authentication or caching policies), poisoning shared caches, or delivering malicious content to end users through a compromised proxy response stream (Go Vuln DB, Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.00188 (~0.19%), indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and technical impact as "partial," though the attack is rated as automatable. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (IDs 365330, 365320) and Qualys (ID 765717) (Feedly).

1. Identify target: Locate a Go-based reverse proxy application (e.g., using net/http or golang.org/x/net/http2) running a vulnerable version (Go < 1.26.9, Go 1.27.0–1.27.1, or golang.org/x/net/http2 < 0.60.0) that proxies HTTP/2 backend responses to HTTP/1 clients.
2. Craft malicious backend response: Control or compromise the HTTP/2 backend server to return a response containing malformed framing-related headers (e.g., a Transfer-Encoding or Content-Length header that is invalid in HTTP/2 context but meaningful in HTTP/1).
3. Forward through proxy: The vulnerable Go reverse proxy, being lax about these headers, forwards the response including the malformed headers to the downstream HTTP/1 client without stripping or rejecting them.
4. Exploit non-strict HTTP/1 client: If the HTTP/1 client (e.g., a browser, another proxy, or a caching layer) does not strictly validate headers, it misinterprets the response boundaries, allowing the attacker to inject additional HTTP responses or content into the client's response stream.
5. Achieve objective: Use the smuggled response to inject malicious content, poison a shared cache, bypass authentication headers, or deliver fraudulent responses to other users sharing the same connection or cache (Go Vuln DB, OSS-Sec).

• Network: Unexpected or duplicate HTTP responses observed at HTTP/1 clients behind a Go-based reverse proxy; responses containing both Transfer-Encoding and Content-Length headers simultaneously, or malformed header values inconsistent with HTTP/2 semantics.
• Logs: Proxy access logs showing unusual response header combinations forwarded to HTTP/1 clients; HTTP/1 client error logs indicating unexpected response parsing or premature end-of-stream conditions.
• Application Behavior: Cache poisoning symptoms such as users receiving responses intended for other users; unexpected content appearing in HTTP/1 client responses not matching the intended backend response.

Update to the patched versions: Go 1.26.9+ (for net/http), Go 1.27.2+ (for net/http/internal/http2), or golang.org/x/net/http2 v0.60.0+ (Go Vuln DB). Microsoft has also released updated Azure Linux 3 packages for affected components (telegraf, cri-tools, cf-cli, azcopy, multus, skopeo) (Microsoft MSRC). SUSE has issued security updates (SUSE-SU-2026:4625-1 and SUSE-SU-2026:4629-1) for affected Go packages (SUSE Advisory 1). As a temporary workaround where patching is not immediately feasible, implement strict HTTP header validation at proxy boundaries or disable HTTP/2 on the reverse proxy until patches can be applied.

The vulnerability was covered in BleepingComputer's summary of Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws (BleepingComputer). The Go security team disclosed the issue via the golang-announce mailing list and published a formal advisory in the Go vulnerability database. SUSE, Mageia, and AusCERT also issued downstream advisories, reflecting broad ecosystem awareness. Community reaction has been measured given the absence of active exploitation and the availability of patches.