Skip to content
Sign in
7.5 High

CVE-2026-56853 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if…

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Affected products and versions

Product Affected versions Fixed in
net/http 1.27 earliest → < 1.27.0-rc.3 1.27.0-rc.3
net/http 1.26 1.26.0-0 → < 1.26.6 1.26.6
net/http 1.25 earliest → < 1.25.13 1.25.13

Other CVEs of net/http

The 26 CVEs of net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 High CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 High
Track this CVE