Log in Start free

Vulnerability · Published Oct 8, 2026 · Assigned by Go

CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/http

High 7.5

In plain English

A high-severity security flaw in net/http from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8delve1.26.1-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:10go-toolset1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8go-toolset1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9go-toolset1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-bin1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-bin1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-bin1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-docs1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-docs1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-docs1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-misc1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-misc1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-misc1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-race1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-race1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-race1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-src1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-src1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-src1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-tests1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-tests1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-tests1.26.10-1.el9_8ALSA-2026:86196
Alpine:v3.24go1.26.9-r0ALPINE-CVE-2026-78660
Debian:12golang-1.19no fix listedDEBIAN-CVE-2026-78660
Debian:13golang-1.24no fix listedDEBIAN-CVE-2026-78660
Debian:14golang-1.261.26.9-1DEBIAN-CVE-2026-78660
Debian:14golang-1.271.27.2-1DEBIAN-CVE-2026-78660
Debian:12golang-golang-x-netno fix listedDEBIAN-CVE-2026-78660
Debian:13golang-golang-x-netno fix listedDEBIAN-CVE-2026-78660
Debian:14golang-golang-x-net1:0.60.0-1DEBIAN-CVE-2026-78660
Gogolang.org/x/net0.60.0GO-2026-6610
Gostdlib1.26.9GO-2026-6610
Gostdlib1.27.2GO-2026-6610
Ubuntu:22.04:LTSadsysno fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSadsysno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSadsysno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10adsysno fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTScontainerdno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10containerdno fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.221.22.2-2~22.04.4USN-8935-1
Ubuntu:22.04:LTSgolang-1.221.22.2-2~22.04.4UBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.221.22.2-2ubuntu0.5UBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.221.22.2-2ubuntu0.5USN-8935-1
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10golang-1.26no fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10golang-1.27no fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgolang-golang-x-netno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgolang-golang-x-netno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10golang-golang-x-netno fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10google-guest-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:22.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:24.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-78660
Ubuntu:26.10google-osconfig-agentno fix listedUBUNTU-CVE-2026-78660

Affected products (as reported)

VendorProductVersions
Go standard library net/http 0 – before 1.26.9
Go standard library net/http/internal/http2 1.27.0-0 – before 1.27.2
golang.org/x/net golang.org/x/net/http2 0 – before 0.60.0

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References