| CVE-2026-97032 |
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78660 |
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78663 |
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream…
|
9.1
Critical
|
Oct 8, 2026 |
| CVE-2026-78667 |
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78669 |
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-94439 |
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-56866 |
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78659 |
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-56853 |
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if…
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-39821 |
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
|
9.6
Critical
|
May 22, 2026 |
| CVE-2026-33814 |
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it…
|
7.5
High
|
May 7, 2026 |
| CVE-2025-58186 |
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit
|
5.3
Medium
|
Oct 29, 2025 |
| CVE-2025-47910 |
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than…
|
5.4
Medium
|
Sep 22, 2025 |
| CVE-2025-4673 |
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive…
|
6.8
Medium
|
Jun 11, 2025 |
| CVE-2025-22870 |
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component
|
4.4
Medium
|
Mar 12, 2025 |
| CVE-2024-45336 |
The HTTP client drops sensitive headers after following a cross-domain redirect
|
6.1
Medium
|
Jan 28, 2025 |
| CVE-2024-24791 |
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue"…
|
7.5
High
|
Jul 2, 2024 |
| CVE-2023-45288 |
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of…
|
7.5
High
|
Apr 4, 2024 |
| CVE-2023-45289 |
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an…
|
4.3
Medium
|
Mar 5, 2024 |
| CVE-2023-39325 |
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource…
|
Not rated
|
Oct 11, 2023 |
| CVE-2023-29406 |
The HTTP/1 client does not fully validate the contents of the Host header
|
Not rated
|
Jul 11, 2023 |
| CVE-2022-41723 |
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a…
|
7.5
High
|
Feb 28, 2023 |
| CVE-2022-41717 |
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
|
Not rated
|
Dec 8, 2022 |
| CVE-2022-41720 |
On Windows, restricted files can be accessed via os.DirFS and http.Dir
|
7.5
High
|
Dec 7, 2022 |
| CVE-2022-32148 |
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling…
|
6.5
Medium
|
Aug 9, 2022 |