GO-2026-6089

vendorUSosv

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

view advisory published 2026-08-13Licence: per source

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-56853US	—	0.57% (47th)	—	2026-08-13
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unex…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/795540FIX
https://go.dev/issue/80205REPORT
https://groups.google.com/g/golang-announce/c/94pEornpRlIWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan