CVE-2026-78669: net/http 0 to before 1.26.9; +2 more affected products

Affected technology

net/http · 0 to before 1.26.9
Go standard library

net/http/internal/http2 · 1.27.0-0 to before 1.27.2
Go standard library

golang.org/x/net/http2 · 0 to before 0.60.0
golang.org/x/net

Component: Not specified by the source
Function: http2outflow.add, http2outflow.available, http2outflow.setConnFlow, http2outflow.take, http2Server.serveConn, http2serverConn.newStream, http2serverConn.processSettingInitialWindowSize, http2serverConn.processWindowUpdate, http2serverConn.scheduleFrameWrite, http2ClientConn.addStreamLocked, http2Transport.newClientConn, http2clientConnReadLoop.processSettingsNoWrite, http2clientConnReadLoop.processWindowUpdate, http2clientConnReadLoop.streamByID, http2clientStream.awaitFlowControl, http2clientStream.cleanupWriteRequest, http2FrameWriteRequest.Consume, CanonicalHeaderKey, Client.CloseIdleConnections, Client.Do, Client.Get, Client.Head, Client.Post, Client.PostForm, ClientConn.Close, ClientConn.RoundTrip, Cookie.String, Cookie.Valid, CrossOriginProtection.AddInsecureBypassPattern, CrossOriginProtection.AddTrustedOrigin, CrossOriginProtection.Check, Dir.Open, Error, Get, Handle, HandleFunc, HandlerFunc.ServeHTTP, Head, Header.Add, Header.Del, Header.Get, Header.Set, Header.Values, Header.Write, Header.WriteSubset, ListenAndServe, ListenAndServeTLS, NewRequest, NewRequestWithContext, NotFound, ParseCookie, ParseSetCookie, ParseTime, Post, PostForm, ProxyFromEnvironment, ReadRequest, ReadResponse, Redirect, Request.AddCookie, Request.BasicAuth, Request.Cookie, Request.Cookies, Request.CookiesNamed, Request.FormFile, Request.FormValue, Request.MultipartReader, Request.ParseForm, Request.ParseMultipartForm, Request.PostFormValue, Request.Referer, Request.SetBasicAuth, Request.UserAgent, Request.Write, Request.WriteProxy, Response.Cookies, Response.Location, Response.Write, ResponseController.EnableFullDuplex, ResponseController.Flush, ResponseController.Hijack, ResponseController.SetReadDeadline, ResponseController.SetWriteDeadline, Serve, ServeContent, ServeFile, ServeFileFS, ServeMux.Handle, ServeMux.HandleFunc, ServeMux.ServeHTTP, ServeTLS, Server.Close, Server.ListenAndServe, Server.ListenAndServeTLS, Server.Serve, Server.ServeTLS, Server.SetKeepAlivesEnabled, Server.Shutdown, SetCookie, Transport.CancelRequest, Transport.Clone, Transport.CloseIdleConnections, Transport.NewClientConn, Transport.RoundTrip, body.Close, body.Read, bodyEOFSignal.Close, bodyEOFSignal.Read, bodyLocked.Read, bufioFlushWriter.Write, cancelTimerBody.Close, cancelTimerBody.Read, checkConnErrorWriter.Write, chunkWriter.Write, connReader.Read, connectMethodKey.String, expectContinueReader.Close, expectContinueReader.Read, extraHeader.Write, fileHandler.ServeHTTP, fileTransport.RoundTrip, globalOptionsHandler.ServeHTTP, gzipReader.Close, gzipReader.Read, http1ClientConn.Close, http1ClientConn.RoundTrip, http2ClientConn.Close, http2ClientConn.Ping, http2ClientConn.RoundTrip, http2ClientConn.Shutdown, http2ConnectionError.Error, http2ErrCode.String, http2FrameHeader.String, http2FrameType.String, http2FrameWriteRequest.String, http2Framer.ReadFrame, http2Framer.ReadFrameForHeader, http2Framer.ReadFrameHeader, http2Framer.WriteContinuation, http2Framer.WriteData, http2Framer.WriteDataPadded, http2Framer.WriteGoAway, http2Framer.WriteHeaders, http2Framer.WritePing, http2Framer.WritePriority, http2Framer.WritePushPromise, http2Framer.WriteRSTStream, http2Framer.WriteRawFrame, http2Framer.WriteSettings, http2Framer.WriteSettingsAck, http2Framer.WriteWindowUpdate, http2GoAwayError.Error, http2Server.ServeConn, http2Setting.String, http2SettingID.String, http2SettingsFrame.ForeachSetting, http2StreamError.Error, http2Transport.CloseIdleConnections, http2Transport.NewClientConn, http2Transport.RoundTrip, http2Transport.RoundTripOpt, http2bufferedWriter.Flush, http2bufferedWriter.Write, http2bufferedWriterTimeoutWriter.Write, http2chunkWriter.Write, http2clientConnPool.GetClientConn, http2connError.Error, http2dataBuffer.Read, http2duplicatePseudoHeaderError.Error, http2gzipReader.Close, http2gzipReader.Read, http2headerFieldNameError.Error, http2headerFieldValueError.Error, http2netHTTPClientConn.Close, http2netHTTPClientConn.RoundTrip, http2noDialClientConnPool.GetClientConn, http2noDialH2RoundTripper.NewClientConn, http2noDialH2RoundTripper.RoundTrip, http2pipe.Read, http2priorityWriteSchedulerRFC7540.CloseStream, http2priorityWriteSchedulerRFC7540.OpenStream, http2priorityWriteSchedulerRFC7540.Pop, http2priorityWriteSchedulerRFC9218.OpenStream, http2priorityWriteSchedulerRFC9218.Pop, http2pseudoHeaderError.Error, http2randomWriteScheduler.Pop, http2requestBody.Close, http2requestBody.Read, http2responseWriter.Flush, http2responseWriter.FlushError, http2responseWriter.Push, http2responseWriter.SetReadDeadline, http2responseWriter.SetWriteDeadline, http2responseWriter.Write, http2responseWriter.WriteHeader, http2responseWriter.WriteString, http2roundRobinWriteScheduler.OpenStream, http2roundRobinWriteScheduler.Pop, http2serverConn.CloseConn, http2serverConn.Flush, http2stickyErrWriter.Write, http2transportResponseBody.Close, http2transportResponseBody.Read, http2unencryptedTransport.RoundTrip, http2writeData.String, initALPNRequest.ServeHTTP, loggingConn.Close, loggingConn.Read, loggingConn.Write, maxBytesReader.Close, maxBytesReader.Read, onceCloseListener.Close, persistConn.Read, persistConnWriter.ReadFrom, persistConnWriter.Write, populateResponse.Write, populateResponse.WriteHeader, readTrackingBody.Close, readTrackingBody.Read, readWriteCloserBody.CloseWrite, readWriteCloserBody.Read, redirectHandler.ServeHTTP, response.Flush, response.FlushError, response.Hijack, response.ReadFrom, response.Write, response.WriteHeader, response.WriteString, serverHandler.ServeHTTP, socksDialer.DialWithConn, socksUsernamePassword.Authenticate, stringWriter.WriteString, timeoutHandler.ServeHTTP, timeoutWriter.Write, timeoutWriter.WriteHeader, transportReadFromServerError.Error, unencryptedHTTP2Request.ServeHTTP, outflow.add, outflow.available, outflow.setConnFlow, outflow.take, Server.serveConn, serverConn.newStream, serverConn.processSettingInitialWindowSize, serverConn.processWindowUpdate, serverConn.scheduleFrameWrite, ClientConn.addStreamLocked, Transport.newClientConn, clientConnReadLoop.processSettingsNoWrite, clientConnReadLoop.processWindowUpdate, clientConnReadLoop.streamByID, clientStream.awaitFlowControl, clientStream.cleanupWriteRequest, FrameWriteRequest.Consume, ClientConn.Ping, ClientConn.Shutdown, Framer.ReadFrame, Framer.ReadFrameForHeader, Framer.ReadFrameHeader, Framer.WriteContinuation, Framer.WriteData, Framer.WriteDataPadded, Framer.WriteGoAway, Framer.WriteHeaders, Framer.WritePing, Framer.WritePriority, Framer.WritePriorityUpdate, Framer.WritePushPromise, Framer.WriteRSTStream, Framer.WriteRawFrame, Framer.WriteSettings, Framer.WriteSettingsAck, Framer.WriteWindowUpdate, NetHTTPClientConn.Close, NetHTTPClientConn.Ping, NetHTTPClientConn.RoundTrip, ReadFrameHeader, Server.GracefulShutdown, Server.ServeConn, SettingsFrame.ForeachSetting, Transport.AddConn, Transport.RoundTripOpt, bufferedWriter.Flush, bufferedWriter.Write, bufferedWriterTimeoutWriter.Write, clientConnPool.GetClientConn, noDialClientConnPool.GetClientConn, priorityWriteSchedulerRFC9218.Pop, requestBody.Close, responseWriter.Flush, responseWriter.FlushError, responseWriter.Push, responseWriter.Write, responseWriter.WriteHeader, responseWriter.WriteString, roundRobinWriteScheduler.Pop, serve400Handler.ServeHTTP, serverConn.Flush, stickyErrWriter.Write, transportResponseBody.Close, transportResponseBody.Read, ConfigureServer, ConfigureTransport, ConfigureTransports, ConnectionError.Error, ErrCode.String, FrameHeader.String, FrameType.String, FrameWriteRequest.String, GoAwayError.Error, Setting.String, SettingID.String, StreamError.Error, connError.Error, dataBuffer.Read, duplicatePseudoHeaderError.Error, headerFieldNameError.Error, headerFieldValueError.Error, netHTTPClientConn.Close, netHTTPClientConn.RoundTrip, noDialH2RoundTripper.NewClientConn, noDialH2RoundTripper.RoundTrip, pipe.Read, priorityWriteSchedulerRFC7540.CloseStream, priorityWriteSchedulerRFC7540.OpenStream, priorityWriteSchedulerRFC7540.Pop, priorityWriteSchedulerRFC9218.OpenStream, pseudoHeaderError.Error, randomWriteScheduler.Pop, requestBody.Read, responseWriter.SetReadDeadline, responseWriter.SetWriteDeadline, roundRobinWriteScheduler.OpenStream, serverConn.CloseConn, unencryptedTransport.RoundTrip, writeData.String

What an attacker can do

The source does not specify what an attacker can achieve.