CVE-2026-78663: 
Go vulnerability analysis and mitigation

CVE-2026-78663 is an HTTP/2 flow control bypass vulnerability in the Go standard library (net/http, net/http/internal/http2) and the golang.org/x/net/http2 package. The flaw allows a malicious client to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by triggering a double refund of flow control credits. It was published on October 8, 2026, and affects Go standard library versions before 1.26.9, Go 1.27.x before 1.27.2, and golang.org/x/net/http2 before 0.60.0. It carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-675 (Multiple Operations on Resource in Single-Operation Context). The HTTP/2 server incorrectly refunds connection-level flow control credits twice for the same data: once when a client resets a stream (crediting back any sent-but-unread data), and again when the request handler reads the buffered data from that stream. An unauthenticated remote attacker can exploit this double-refund logic to accumulate more buffered data than MaxReceiveBufferPerConnection permits, though total buffered data remains bounded by concurrent stream limits and stream-level flow control. Relevant patches are tracked at Go issue #81743 and changelists CL/847187 and CL/847310 (Red Hat Bugzilla, Red Hat Advisory).

A successful exploit allows an unauthenticated network attacker to exhaust server memory by sending crafted HTTP/2 requests that bypass connection-level flow control limits, leading to service degradation or crashes (denial of service). The CVSS scoring reflects high availability and integrity impact with no confidentiality impact, and the vulnerability is classified as automatable with total technical impact. Any Go-based HTTP/2 server using the affected packages — including applications built on Docker (Moby), rclone, and other Go ecosystem projects — is potentially affected (Red Hat Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The NVD SSVC assessment classifies exploitation as "none" currently, though the attack is automatable and requires no authentication or user interaction. The EPSS score is approximately 0.248%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

Upgrade to the patched versions as the primary remediation: Go standard library net/http to version 1.26.9 or later, net/http/internal/http2 to version 1.27.2 or later (for Go 1.27.x users), and golang.org/x/net/http2 to version 0.60.0 or later. As a defense-in-depth measure while patching is being deployed, implement additional application-level rate limiting and resource quotas, and monitor HTTP/2 server memory consumption for anomalous growth patterns. Downstream projects such as Docker (Moby v29.9.0) and rclone have already released updates incorporating the fix (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was included in Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws including three zero-days, giving CVE-2026-78663 broader visibility (BleepingComputer). Red Hat, SUSE, Mageia, and AusCERT have all issued advisories or security bulletins referencing the vulnerability. The Go security team announced the fix via the golang-announce mailing list, and the issue was disclosed on the oss-security mailing list shortly after publication.