CVE-2026-97032
Description
A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.
Statement
This flaw is rated with a Moderate severity for Red Hat products because, although remotely triggerable without authentication, successful exploitation relies on winning a race condition and causes only a denial of service without compromising system confidentiality or integrity. Within Red Hat environments, exposure is limited to network services and server applications built with the Go runtime that actively handle HTTP/2 connections. Applications communicating strictly over HTTP/1.1 or where client connections do not modify header compression parameters are not vulnerable.
Mitigation
Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients.
For applications managed by systemd, configure the environment variable by creating a service override:
systemctl edit <service-name>
Add the following lines under the [Service] section:
[Service]
Environment="GODEBUG=http2server=0"
Apply the changes and restart the daemon:
systemctl daemon-reload
systemctl restart <service-name>
To limit network exposure using firewalld, restrict access to trusted networks:
firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent
firewall-cmd --reload
Caveats:
Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC.
Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
