Known vulnerabilities in Go standard library net/http/internal/http2
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-78663 | The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… | 9.1 Critical | Oct 8, 2026 |
| CVE-2026-39821 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label | 9.6 Critical | May 22, 2026 |