CVE-2026-78669: 
Go vulnerability analysis and mitigation

CVE-2026-78669 is a Denial of Service vulnerability in Go's HTTP/2 implementation affecting the net/http, net/http/internal/http2 packages in the Go standard library, and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values (Red Hat Bugzilla). Affected versions include golang.org/x/net/http2 before 0.60.0, Go standard library net/http before 1.26.9, and net/http/internal/http2 versions 1.27.0-0 through before 1.27.2. The vulnerability was published on October 8, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-405 (Asymmetric Resource Consumption / Amplification). An attacker exploits the HTTP/2 protocol by first opening a large number of streams, then repeatedly sending small SETTINGS frames with varying SETTINGS_INITIAL_WINDOW_SIZE values; each change forces the receiver to recompute flow control windows for all open streams, resulting in disproportionate CPU consumption relative to the attacker's bandwidth cost (Red Hat Bugzilla). No authentication or user interaction is required — any network-accessible HTTP/2 endpoint using a vulnerable Go version is a valid target. Patches are tracked in the Go issue tracker at go.dev/issue/81742 and applied via changelists go.dev/cl/847186 and go.dev/cl/847308.

Successful exploitation causes excessive CPU consumption on the targeted HTTP/2 client or server, leading to service degradation or complete unavailability (Denial of Service). There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Any Go-based service or application using the affected HTTP/2 packages and exposed to untrusted network peers is at risk, including downstream products such as Docker (moby), Terraform, rclone, Tailscale, and various Microsoft Azure Linux packages (Red Hat Advisory, Microsoft MSRC).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.227%, indicating a low near-term probability of exploitation. The vulnerability is marked as automatable (no user interaction required), making it straightforward to weaponize once a PoC is developed. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing services built with Go that expose HTTP/2 endpoints (e.g., via Shodan, Censys, or direct probing with curl --http2), targeting versions of golang.org/x/net/http2 before 0.60.0 or Go standard library before 1.26.9/1.27.2.
2. Establish HTTP/2 connection: Open an HTTP/2 connection to the target server and negotiate a large number of concurrent streams (up to the server's SETTINGS_MAX_CONCURRENT_STREAMS limit).
3. Send rapid SETTINGS frames: Repeatedly send small HTTP/2 SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values to the server across all open streams, varying the value with each frame to force continuous flow-control recalculation.
4. Sustain the attack: Maintain the stream count and SETTINGS frame rate to keep CPU utilization elevated on the target, causing service degradation or unavailability with minimal attacker bandwidth (Red Hat Bugzilla).

• Network: Unusually high volume of HTTP/2 SETTINGS frames from a single or small set of source IPs; large numbers of concurrent HTTP/2 streams from a single peer; sustained high-rate HTTP/2 traffic with minimal data payload.
• System: Sustained high CPU utilization on Go-based HTTP/2 server or client processes without a corresponding increase in legitimate request throughput.
• Logs: Application or access logs showing a high rate of connections or stream openings from specific remote addresses with little to no meaningful request data; Go runtime profiling showing excessive time spent in HTTP/2 flow-control or SETTINGS processing routines.

Update golang.org/x/net/http2 to version 0.60.0 or later, Go standard library net/http to version 1.26.9 or later, and net/http/internal/http2 to version 1.27.2 or later (Red Hat Bugzilla). Downstream consumers such as Docker, Terraform, rclone, and Microsoft Azure Linux packages should update to versions that incorporate the patched Go dependency. As a temporary network-level workaround, rate-limiting or restricting HTTP/2 connections from untrusted peers at the load balancer or firewall level can reduce exposure until patching is complete. Red Hat users should monitor the advisory at bugzilla.redhat.com/show_bug.cgi?id=2548344 for package-specific updates (Red Hat Advisory).

The vulnerability was included in Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws, drawing broad media coverage including from BleepingComputer. Multiple Linux distributions including SUSE and Mageia issued advisories, and downstream projects such as Docker (moby v29.9.0), Terraform (v1.16.6), rclone, and Tailscale released updates incorporating the fix. Community discussion was noted on the golang-announce mailing list and oss-security, consistent with standard Go security disclosure practices.