CVE-2026-78663: net/http 0 to before 1.26.9; +2 more affected products

Affected technology

net/http · 0 to before 1.26.9
Go standard library

net/http/internal/http2 · 1.27.0-0 to before 1.27.2
Go standard library

golang.org/x/net/http2 · 0 to before 0.60.0
golang.org/x/net

Component: Not specified by the source
Function: http2requestBody.Close, http2requestBody.Read, http2serverConn.closeStream, http2serverConn.handlerDone, http2serverConn.newWriterAndRequest, http2serverConn.newWriterAndRequestNoBody, http2serverConn.noteBodyRead, http2serverConn.processHeaders, http2serverConn.runHandler, http2serverConn.scheduleHandler, CanonicalHeaderKey, Client.CloseIdleConnections, Client.Do, Client.Get, Client.Head, Client.Post, Client.PostForm, ClientConn.Close, ClientConn.RoundTrip, Cookie.String, Cookie.Valid, CrossOriginProtection.AddInsecureBypassPattern, CrossOriginProtection.AddTrustedOrigin, CrossOriginProtection.Check, Dir.Open, Error, Get, Handle, HandleFunc, HandlerFunc.ServeHTTP, Head, Header.Add, Header.Del, Header.Get, Header.Set, Header.Values, Header.Write, Header.WriteSubset, ListenAndServe, ListenAndServeTLS, NewRequest, NewRequestWithContext, NotFound, ParseCookie, ParseSetCookie, ParseTime, Post, PostForm, ProxyFromEnvironment, ReadRequest, ReadResponse, Redirect, Request.AddCookie, Request.BasicAuth, Request.Cookie, Request.Cookies, Request.CookiesNamed, Request.FormFile, Request.FormValue, Request.MultipartReader, Request.ParseForm, Request.ParseMultipartForm, Request.PostFormValue, Request.Referer, Request.SetBasicAuth, Request.UserAgent, Request.Write, Request.WriteProxy, Response.Cookies, Response.Location, Response.Write, ResponseController.EnableFullDuplex, ResponseController.Flush, ResponseController.Hijack, ResponseController.SetReadDeadline, ResponseController.SetWriteDeadline, Serve, ServeContent, ServeFile, ServeFileFS, ServeMux.Handle, ServeMux.HandleFunc, ServeMux.ServeHTTP, ServeTLS, Server.Close, Server.ListenAndServe, Server.ListenAndServeTLS, Server.Serve, Server.ServeTLS, Server.SetKeepAlivesEnabled, Server.Shutdown, SetCookie, Transport.CancelRequest, Transport.Clone, Transport.CloseIdleConnections, Transport.NewClientConn, Transport.RoundTrip, body.Close, body.Read, bodyEOFSignal.Close, bodyEOFSignal.Read, bodyLocked.Read, bufioFlushWriter.Write, cancelTimerBody.Close, cancelTimerBody.Read, checkConnErrorWriter.Write, chunkWriter.Write, connReader.Read, connectMethodKey.String, expectContinueReader.Close, expectContinueReader.Read, extraHeader.Write, fileHandler.ServeHTTP, fileTransport.RoundTrip, globalOptionsHandler.ServeHTTP, gzipReader.Close, gzipReader.Read, http1ClientConn.Close, http1ClientConn.RoundTrip, http2ClientConn.Close, http2ClientConn.Ping, http2ClientConn.RoundTrip, http2ClientConn.Shutdown, http2ConnectionError.Error, http2ErrCode.String, http2FrameHeader.String, http2FrameType.String, http2FrameWriteRequest.String, http2Framer.ReadFrame, http2Framer.ReadFrameForHeader, http2Framer.ReadFrameHeader, http2Framer.WriteContinuation, http2Framer.WriteData, http2Framer.WriteDataPadded, http2Framer.WriteGoAway, http2Framer.WriteHeaders, http2Framer.WritePing, http2Framer.WritePriority, http2Framer.WritePushPromise, http2Framer.WriteRSTStream, http2Framer.WriteRawFrame, http2Framer.WriteSettings, http2Framer.WriteSettingsAck, http2Framer.WriteWindowUpdate, http2GoAwayError.Error, http2Server.ServeConn, http2Setting.String, http2SettingID.String, http2SettingsFrame.ForeachSetting, http2StreamError.Error, http2Transport.CloseIdleConnections, http2Transport.NewClientConn, http2Transport.RoundTrip, http2Transport.RoundTripOpt, http2bufferedWriter.Flush, http2bufferedWriter.Write, http2bufferedWriterTimeoutWriter.Write, http2chunkWriter.Write, http2clientConnPool.GetClientConn, http2connError.Error, http2dataBuffer.Read, http2duplicatePseudoHeaderError.Error, http2gzipReader.Close, http2gzipReader.Read, http2headerFieldNameError.Error, http2headerFieldValueError.Error, http2netHTTPClientConn.Close, http2netHTTPClientConn.RoundTrip, http2noDialClientConnPool.GetClientConn, http2noDialH2RoundTripper.NewClientConn, http2noDialH2RoundTripper.RoundTrip, http2pipe.Read, http2priorityWriteSchedulerRFC7540.CloseStream, http2priorityWriteSchedulerRFC7540.OpenStream, http2priorityWriteSchedulerRFC9218.OpenStream, http2pseudoHeaderError.Error, http2responseWriter.Flush, http2responseWriter.FlushError, http2responseWriter.Push, http2responseWriter.SetReadDeadline, http2responseWriter.SetWriteDeadline, http2responseWriter.Write, http2responseWriter.WriteHeader, http2responseWriter.WriteString, http2roundRobinWriteScheduler.OpenStream, http2serverConn.CloseConn, http2serverConn.Flush, http2stickyErrWriter.Write, http2transportResponseBody.Close, http2transportResponseBody.Read, http2unencryptedTransport.RoundTrip, http2writeData.String, initALPNRequest.ServeHTTP, loggingConn.Close, loggingConn.Read, loggingConn.Write, maxBytesReader.Close, maxBytesReader.Read, onceCloseListener.Close, persistConn.Read, persistConnWriter.ReadFrom, persistConnWriter.Write, populateResponse.Write, populateResponse.WriteHeader, readTrackingBody.Close, readTrackingBody.Read, readWriteCloserBody.CloseWrite, readWriteCloserBody.Read, redirectHandler.ServeHTTP, response.Flush, response.FlushError, response.Hijack, response.ReadFrom, response.Write, response.WriteHeader, response.WriteString, serverHandler.ServeHTTP, socksDialer.DialWithConn, socksUsernamePassword.Authenticate, stringWriter.WriteString, timeoutHandler.ServeHTTP, timeoutWriter.Write, timeoutWriter.WriteHeader, transportReadFromServerError.Error, unencryptedHTTP2Request.ServeHTTP, requestBody.Close, requestBody.Read, serverConn.closeStream, serverConn.handlerDone, serverConn.newWriterAndRequest, serverConn.newWriterAndRequestNoBody, serverConn.noteBodyRead, serverConn.processHeaders, serverConn.runHandler, serverConn.scheduleHandler, Server.ServeConn, ClientConn.Ping, ClientConn.Shutdown, ConfigureServer, ConfigureTransport, ConfigureTransports, ConnectionError.Error, ErrCode.String, FrameHeader.String, FrameType.String, FrameWriteRequest.String, Framer.ReadFrame, Framer.ReadFrameForHeader, Framer.ReadFrameHeader, Framer.WriteContinuation, Framer.WriteData, Framer.WriteDataPadded, Framer.WriteGoAway, Framer.WriteHeaders, Framer.WritePing, Framer.WritePriority, Framer.WritePriorityUpdate, Framer.WritePushPromise, Framer.WriteRSTStream, Framer.WriteRawFrame, Framer.WriteSettings, Framer.WriteSettingsAck, Framer.WriteWindowUpdate, GoAwayError.Error, ReadFrameHeader, Setting.String, SettingID.String, SettingsFrame.ForeachSetting, StreamError.Error, Transport.RoundTripOpt, bufferedWriter.Flush, bufferedWriter.Write, bufferedWriterTimeoutWriter.Write, clientConnPool.GetClientConn, connError.Error, dataBuffer.Read, duplicatePseudoHeaderError.Error, headerFieldNameError.Error, headerFieldValueError.Error, netHTTPClientConn.Close, netHTTPClientConn.RoundTrip, noDialClientConnPool.GetClientConn, noDialH2RoundTripper.NewClientConn, noDialH2RoundTripper.RoundTrip, pipe.Read, priorityWriteSchedulerRFC7540.CloseStream, priorityWriteSchedulerRFC7540.OpenStream, priorityWriteSchedulerRFC9218.OpenStream, pseudoHeaderError.Error, responseWriter.Flush, responseWriter.FlushError, responseWriter.Push, responseWriter.SetReadDeadline, responseWriter.SetWriteDeadline, responseWriter.Write, responseWriter.WriteHeader, responseWriter.WriteString, roundRobinWriteScheduler.OpenStream, serverConn.CloseConn, serverConn.Flush, stickyErrWriter.Write, transportResponseBody.Close, transportResponseBody.Read, unencryptedTransport.RoundTrip, writeData.String

What an attacker can do

The source does not specify what an attacker can achieve.