{"id":"CVE-2026-78663","published":"2026-10-08T23:17:03Z","modified":"2026-10-09T17:16:49Z","title":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream…","vendor":"Go standard library","product":"net/http","tier":"core","eol":null,"description":{"text":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","provenance":"source","from":"NVD"},"summary":{"text":"The HTTP/2 server in the Go standard library's net/http package can refund connection-level flow control twice for the same data, once on a client stream reset and again when a request handler reads the buffered data, which undermines the configured connection-level receive buffer limit. A remote, unauthenticated client can exploit this by sending HTTP/2 requests with no user interaction, and the total buffered data remains bounded by the concurrent stream limit and stream-level flow control.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:14Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00622,"percentile":0.4977,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":12,"pulses":[{"name":"Known_Cve | Oct 21, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad781365a703b9c48649e66","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad62f6910d6449918d5e634","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad4dda86020bf504fd274dd","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad38c282daff94afd324191","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad23ab08ed96f8b8bdea241","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ad0e933fc9a5a47b66d7921","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ace4672cf606a4598005652","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6accf72a849f791bc729312a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6acba8aca71285f9db866402","created":"2026-10-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-675","name":"Multiple Operations on Resource in Single-Operation Context"}],"references":[{"url":"https://go.dev/cl/847187","tags":[]},{"url":"https://go.dev/cl/847310","tags":[]},{"url":"https://go.dev/issue/81743","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6612","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.26.9",">=1.27.0-0, <1.27.2"],"patched":["1.26.9","1.27.2"],"from":["GO-2026-6612"],"provenance":"source"},{"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.60.0"],"patched":["0.60.0"],"from":["GO-2026-6612"],"provenance":"source"}],"advisories":[{"id":"GO-2026-6612","url":"https://osv.dev/vulnerability/GO-2026-6612","severity":null,"ecosystem":"Go","package":"stdlib","vulnerableRanges":["<1.26.9"],"patched":["1.26.9"],"provenance":"source","from":"OSV"},{"id":"GO-2026-6612","url":"https://osv.dev/vulnerability/GO-2026-6612","severity":null,"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.60.0"],"patched":["0.60.0"],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2026-95427","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95427","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.95,"detail":"percentile 0.4977"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.53,"detail":"12 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}