Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-08T22:54:00 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-366

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.

This flaw is rated with a Moderate severity for Red Hat products because, although remotely triggerable without authentication, successful exploitation relies on winning a race condition and causes only a denial of service without compromising system confidentiality or integrity. Within Red Hat environments, exposure is limited to network services and server applications built with the Go runtime that actively handle HTTP/2 connections. Applications communicating strictly over HTTP/1.1 or where client connections do not modify header compression parameters are not vulnerable. Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients. For applications managed by systemd, configure the environment variable by creating a service override: systemctl edit <service-name> Add the following lines under the [Service] section: [Service] Environment="GODEBUG=http2server=0" Apply the changes and restart the daemon: systemctl daemon-reload systemctl restart <service-name> To limit network exposure using firewalld, restrict access to trusted networks: firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC. Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability. OpenShift Developer Tools and Services Out of support scope helm OpenShift Pipelines Fix deferred openshift-pipelines-client OpenShift Serverless Fix deferred kn-workflow-plugin OpenShift Serverless Fix deferred openshift-serverless-clients OpenShift Service Mesh 3 Fix deferred istio-proxy OpenShift Service Mesh 3 Affected openshift-golang-builder-container Red Hat Ansible Automation Platform 2 Fix deferred automation-gateway-proxy Red Hat Ansible Automation Platform 2 Out of support scope automation-gateway-proxy-openssl30 Red Hat Ansible Automation Platform 2 Out of support scope automation-gateway-proxy-openssl32 Red Hat Ansible Automation Platform 2 Fix deferred receptor Red Hat Ceph Storage 7 Fix deferred thrift Red Hat Ceph Storage 8 Fix deferred thrift Red Hat Ceph Storage 9 Fix deferred libarrow Red Hat Ceph Storage 9 Fix deferred thrift Red Hat Certification Program for Red Hat Enterprise Linux 9 Fix deferred redhat-certification-cnf Red Hat Certification Program for Red Hat Enterprise Linux 9 Fix deferred redhat-certification-preflight Red Hat Edge Manager 1 Fix deferred flightctl Red Hat Enterprise Linux 10 Fix deferred buildah Red Hat Enterprise Linux 10 Fix deferred butane Red Hat Enterprise Linux 10 Fix deferred conmon Red Hat Enterprise Linux 10 Fix deferred delve Red Hat Enterprise Linux 10 Fix deferred git-lfs Red Hat Enterprise Linux 10 Fix deferred go-fdo-client Red Hat Enterprise Linux 10 Fix deferred go-fdo-server Red Hat Enterprise Linux 10 Fix deferred golang Red Hat Enterprise Linux 10 Fix deferred golang-github-openprinting-ipp-usb Red Hat Enterprise Linux 10 Fix deferred grafana Red Hat Enterprise Linux 10 Fix deferred grafana-pcp Red Hat Enterprise Linux 10 Fix deferred gvisor-tap-vsock Red Hat Enterprise Linux 10 Fix deferred ignition Red Hat Enterprise Linux 10 Fix deferred image-builder Red Hat Enterprise Linux 10 Fix deferred oci-delta Red Hat Enterprise Linux 10 Fix deferred oci-seccomp-bpf-hook Red Hat Enterprise Linux 10 Fix deferred opentelemetry-collector Red Hat Enterprise Linux 10 Fix deferred osbuild-composer Red Hat Enterprise Linux 10 Fix deferred podman Red Hat Enterprise Linux 10 Fix deferred rhc Red Hat Enterprise Linux 10 Fix deferred rhc-worker-playbook Red Hat Enterprise Linux 10 Fix deferred skopeo Red Hat Enterprise Linux 10 Fix deferred toolbox Red Hat Enterprise Linux 10 Fix deferred trustee Red Hat Enterprise Linux 10 Fix deferred trustee-guest-components Red Hat Enterprise Linux 10 Fix deferred weldr-client Red Hat Enterprise Linux 10 Fix deferred yggdrasil Red Hat Enterprise Linux 7 Fix deferred compat-sap-c++-11 Red Hat Enterprise Linux 7 Fix deferred host-metering Red Hat Enterprise Linux 7 Fix deferred rhc Red Hat Enterprise Linux 7 Fix deferred rhc-worker-script Red Hat Enterprise Linux 8 Fix deferred compat-sap-c++-11 Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/buildah Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/conmon Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/containernetworking-plugins Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/crun Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/oci-seccomp-bpf-hook Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/podman Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/runc Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/skopeo Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/toolbox Red Hat Enterprise Linux 8 Fix deferred git-lfs Red Hat Enterprise Linux 8 Fix deferred go-toolset:rhel8/golang Red Hat Enterprise Linux 8 Fix deferred grafana Red Hat Enterprise Linux 8 Fix deferred grafana-pcp Red Hat Enterprise Linux 8 Fix deferred osbuild-composer Red Hat Enterprise Linux 8 Fix deferred rhc Red Hat Enterprise Linux 8 Fix deferred weldr-client Red Hat Enterprise Linux 9 Fix deferred buildah Red Hat Enterprise Linux 9 Fix deferred butane Red Hat Enterprise Linux 9 Fix deferred conmon Red Hat Enterprise Linux 9 Fix deferred containernetworking-plugins Red Hat Enterprise Linux 9 Fix deferred delve Red Hat Enterprise Linux 9 Fix deferred git-lfs Red Hat Enterprise Linux 9 Fix deferred golang Red Hat Enterprise Linux 9 Fix deferred grafana Red Hat Enterprise Linux 9 Fix deferred grafana-pcp Red Hat Enterprise Linux 9 Fix deferred gvisor-tap-vsock Red Hat Enterprise Linux 9 Fix deferred ignition Red Hat Enterprise Linux 9 Fix deferred image-builder Red Hat Enterprise Linux 9 Fix deferred oci-delta Red Hat Enterprise Linux 9 Fix deferred oci-seccomp-bpf-hook Red Hat Enterprise Linux 9 Fix deferred opentelemetry-collector Red Hat Enterprise Linux 9 Fix deferred osbuild-composer Red Hat Enterprise Linux 9 Fix deferred podman Red Hat Enterprise Linux 9 Fix deferred rhc Red Hat Enterprise Linux 9 Fix deferred skopeo Red Hat Enterprise Linux 9 Fix deferred toolbox Red Hat Enterprise Linux 9 Fix deferred trustee-guest-components Red Hat Enterprise Linux 9 Fix deferred weldr-client Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred golang Red Hat OpenShift Container Platform 4 Fix deferred butane Red Hat OpenShift Container Platform 4 Fix deferred conmon Red Hat OpenShift Container Platform 4 Fix deferred conmon-rs Red Hat OpenShift Container Platform 4 Fix deferred containernetworking-plugins Red Hat OpenShift Container Platform 4 Fix deferred cri-o Red Hat OpenShift Container Platform 4 Fix deferred cri-tools Red Hat OpenShift Container Platform 4 Fix deferred golang-github-prometheus-promu Red Hat OpenShift Container Platform 4 Fix deferred ignition Red Hat OpenShift Container Platform 4 Fix deferred kata-containers Red Hat OpenShift Container Platform 4 Fix deferred microshift Red Hat OpenShift Container Platform 4 Fix deferred openshift Red Hat OpenShift Container Platform 4 Fix deferred openshift-clients Red Hat OpenShift Container Platform 4 Affected openshift-golang-builder-container Red Hat OpenShift Container Platform 4 Fix deferred openshift-kuryr Red Hat OpenShift Container Platform 4 Fix deferred ose-aws-ecr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred ose-azure-acr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred ose-crio-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred ose-gcp-gcr-image-credential-provider Red Hat OpenShift Container Platform 4 Fix deferred podman Red Hat OpenShift Container Platform 4 Fix deferred skopeo Red Hat OpenShift Container Platform 4 Fix deferred toolbox Red Hat OpenShift on AWS Fix deferred rosa Red Hat OpenShift Virtualization 4 Affected openshift-golang-builder-container Red Hat OpenStack Platform 16.2 Out of support scope etcd Red Hat OpenStack Platform 16.2 Out of support scope golang-github-infrawatch-apputils Red Hat OpenStack Platform 16.2 Out of support scope golang-github-Sirupsen-logrus Red Hat OpenStack Platform 17.1 Out of support scope collectd-libpod-stats Red Hat OpenStack Platform 17.1 Out of support scope etcd Red Hat OpenStack Platform 17.1 Out of support scope golang-github-infrawatch-apputils Red Hat OpenStack Platform 17.1 Out of support scope golang-github-Sirupsen-logrus Red Hat OpenStack Platform 17.1 Out of support scope golang-uber-atomic Red Hat OpenStack Platform 17.1 Out of support scope golang-uber-multierr Red Hat OpenStack Platform 18.0 Fix deferred etcd Red Hat OpenStack Platform 18.0 Fix deferred golang-github-openstack-k8s-operators-os-diff Red Hat Satellite 6 Fix deferred yggdrasil-worker-forwarder Red Hat Service Interconnect 1 Out of support scope skupper-cli Red Hat Service Interconnect 2 Fix deferred skupper-cli streams for Apache Kafka 2 Out of support scope golang-github-danielqsj-kafka_exporter streams for Apache Kafka 3 Fix deferred golang-github-danielqsj-kafka_exporter https://www.cve.org/CVERecord?id=CVE-2026-97032 https://nvd.nist.gov/vuln/detail/CVE-2026-97032 https://go.dev/cl/847188 https://go.dev/cl/847313 https://go.dev/issue/81867 https://groups.google.com/g/golang-announce/c/U2fTuyDJznI https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs https://pkg.go.dev/vuln/GO-2026-6617