CVE-2026-78659
Description
A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service (DoS) by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker can exhaust system memory resources and cause the application to crash.
Statement
A memory exhaustion flaw was found in Go's net/http package. When an HTTP/2 client sends a "Trailer" header declaring a large number of trailer fields, the server allocates memory for each declared field when populating the Request.Trailer map, bypassing the Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. A remote attacker could exploit this by sending specially crafted HTTP/2 requests to exhaust server memory and cause a denial of service.
This issue only affects applications that operate an HTTP/2 server and process client-supplied trailer headers; HTTP/1 servers are not affected because they do not multiplex requests over a single connection and calculate header limits differently.
This flaw was fixed in Go 1.26.9 and 1.27.2 (net/http), and in golang.org/x/net/http2 v0.60.0 for code using the x/net module.
Mitigation
There is no configuration-based mitigation for applications that must accept client-supplied trailer headers over HTTP/2. Possible mitigations are:
- Disable HTTP/2 in the affected server (e.g. do not configure http2 via TLSNextProto / do not serve over h2), forcing HTTP/1.1 where the issue does not apply.
- Terminate HTTP/2 at a reverse proxy or load balancer that limits request/header sizes and does not forward excessive trailer declarations to the backend.
- Restrict network access to the HTTP/2 endpoint so that only trusted clients can connect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
