CVE-2026-78663— Double flow control refund on HTTP/2 server streams in net/http
Quick assessment
Affected
Go standard library net/http
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HTTP/2 服务器会对同一数据错误地执行两次连接级流量控制退款（refunding）：一次是在客户端重置某个流时（为已发送但未被读取的流数据部分退款），另一次是在请求处理程序读取缓冲区中的这些数据时。恶意客户端可利用此漏洞绕过配置的连接级流量控制上限（MaxReceiveBufferPerConnection）。不过，总缓冲数据量仍会受到并发流数上限和流级流量控制的限制。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78663
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Double flow control refund on HTTP/2 server streams in net/http
Source: CVE Program / CVE List V5
Vulnerability Description
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Go standard library | net/http | 0 ~ 1.26.9 | - |
|
| Go standard library | net/http/internal/http2 | 1.27.0-0 ~ 1.27.2 | - |
|
| golang.org/x/net | golang.org/x/net/http2 | 0 ~ 0.60.0 | - |
|
II. Public POCs for CVE-2026-78663
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78663
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78663 (2)
Vendor Pages for CVE-2026-78663 (1)
Other References for CVE-2026-78663 (1)
Other References for CVE-2026-78663 (2)
Same Patch Batch · Go standard library · 2026-10-08 · 13 CVEs total
| CVE-2026-94439 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | |
| CVE-2026-94440 | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart | |
| CVE-2026-94448 | Reset context tracking on consecutive template expressions in html/template | |
| CVE-2026-56857 | Root.Mkdir(All) can follow junctions out of the root on Windows in os | |
| CVE-2026-56866 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | |
| CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | |
| CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | |
| CVE-2026-78667 | Lack of limit on size of parsed Range headers in net/http | |
| CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | |
| CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | |
| CVE-2026-97030 | Recognize yield as regexp preceder keyword in html/template | |
| CVE-2026-97031 | Reject malformed ECH outer extension references in crypto/tls |
IV. Related Vulnerabilities
Same product: net/http
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http -
CVE-2026-78669
Excessive CPU consumption from repeated initial window chang -
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT -
CVE-2026-78660
HTTP/2 transport accepts malformed framing-related headers i -
CVE-2026-78667
Lack of limit on size of parsed Range headers in net/http
Same vendor: Go standard library
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http -
CVE-2026-78669
Excessive CPU consumption from repeated initial window chang -
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT -
CVE-2026-78667
Lack of limit on size of parsed Range headers in net/http -
CVE-2026-97031
Reject malformed ECH outer extension references in crypto/tl
V. Comments for CVE-2026-78663
No comments yet