CVE-2026-78660: net/http 0 to before 1.26.9; +2 more affected products

Affected technology

net/http · 0 to before 1.26.9
Go standard library

net/http/internal/http2 · 1.27.0-0 to before 1.27.2
Go standard library

golang.org/x/net/http2 · 0 to before 0.60.0
golang.org/x/net

Component: Not specified by the source
Function: http2clientConnReadLoop.handleResponse, Client.CloseIdleConnections, Client.Do, Client.Get, Client.Head, Client.Post, Client.PostForm, ClientConn.Close, ClientConn.RoundTrip, Get, Head, Post, PostForm, Transport.CloseIdleConnections, Transport.NewClientConn, Transport.RoundTrip, http1ClientConn.Close, http1ClientConn.RoundTrip, http2Transport.NewClientConn, http2Transport.RoundTrip, http2Transport.RoundTripOpt, http2clientConnPool.GetClientConn, http2noDialClientConnPool.GetClientConn, http2noDialH2RoundTripper.NewClientConn, http2noDialH2RoundTripper.RoundTrip, http2unencryptedTransport.RoundTrip, clientConnReadLoop.handleResponse, Transport.AddConn, Transport.RoundTripOpt, clientConnPool.GetClientConn, noDialClientConnPool.GetClientConn, noDialH2RoundTripper.NewClientConn, noDialH2RoundTripper.RoundTrip, unencryptedTransport.RoundTrip

What an attacker can do

The source does not specify what an attacker can achieve.