GO-2026-6612
- Source
- https://pkg.go.dev/vuln/GO-2026-6612
- Import Source
- https://vuln.go.dev/ID/GO-2026-6612.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6612
- Aliases
-
- CVE-2026-78663
- Published
- 2026-10-08T22:31:09Z
- Modified
- 2026-10-08T23:00:13Z
- Summary
- Double flow control refund on HTTP/2 server streams in net/http
- Details
-
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6612" }- References
- Credits
-
-
- Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)
-
Affected packages
Go / stdlib
Package
- Name
- stdlib
- View open source insights on deps.dev
- Purl
- pkg:golang/stdlib
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.26.9
Ecosystem specific
{
"imports": [
{
"path": "net/http",
"symbols": [
"CanonicalHeaderKey",
"Client.CloseIdleConnections",
"Client.Do",
"Client.Get",
"Client.Head",
"Client.Post",
"Client.PostForm",
"ClientConn.Close",
"ClientConn.RoundTrip",
"Cookie.String",
"Cookie.Valid",
"CrossOriginProtection.AddInsecureBypassPattern",
"CrossOriginProtection.AddTrustedOrigin",
"CrossOriginProtection.Check",
"Dir.Open",
"Error",
"Get",
"Handle",
"HandleFunc",
"HandlerFunc.ServeHTTP",
"Head",
"Header.Add",
"Header.Del",
"Header.Get",
"Header.Set",
"Header.Values",
"Header.Write",
"Header.WriteSubset",
"ListenAndServe",
"ListenAndServeTLS",
"NewRequest",
"NewRequestWithContext",
"NotFound",
"ParseCookie",
"ParseSetCookie",
"ParseTime",
"Post",
"PostForm",
"ProxyFromEnvironment",
"ReadRequest",
"ReadResponse",
"Redirect",
"Request.AddCookie",
"Request.BasicAuth",
"Request.Cookie",
"Request.Cookies",
"Request.CookiesNamed",
"Request.FormFile",
"Request.FormValue",
"Request.MultipartReader",
"Request.ParseForm",
"Request.ParseMultipartForm",
"Request.PostFormValue",
"Request.Referer",
"Request.SetBasicAuth",
"Request.UserAgent",
"Request.Write",
"Request.WriteProxy",
"Response.Cookies",
"Response.Location",
"Response.Write",
"ResponseController.EnableFullDuplex",
"ResponseController.Flush",
"ResponseController.Hijack",
"ResponseController.SetReadDeadline",
"ResponseController.SetWriteDeadline",
"Serve",
"ServeContent",
"ServeFile",
"ServeFileFS",
"ServeMux.Handle",
"ServeMux.HandleFunc",
"ServeMux.ServeHTTP",
"ServeTLS",
"Server.Close",
"Server.ListenAndServe",
"Server.ListenAndServeTLS",
"Server.Serve",
"Server.ServeTLS",
"Server.SetKeepAlivesEnabled",
"Server.Shutdown",
"SetCookie",
"Transport.CancelRequest",
"Transport.Clone",
"Transport.CloseIdleConnections",
"Transport.NewClientConn",
"Transport.RoundTrip",
"body.Close",
"body.Read",
"bodyEOFSignal.Close",
"bodyEOFSignal.Read",
"bodyLocked.Read",
"bufioFlushWriter.Write",
"cancelTimerBody.Close",
"cancelTimerBody.Read",
"checkConnErrorWriter.Write",
"chunkWriter.Write",
"connReader.Read",
"connectMethodKey.String",
"expectContinueReader.Close",
"expectContinueReader.Read",
"extraHeader.Write",
"fileHandler.ServeHTTP",
"fileTransport.RoundTrip",
"globalOptionsHandler.ServeHTTP",
"gzipReader.Close",
"gzipReader.Read",
"http1ClientConn.Close",
"http1ClientConn.RoundTrip",
"http2ClientConn.Close",
"http2ClientConn.Ping",
"http2ClientConn.RoundTrip",
"http2ClientConn.Shutdown",
"http2ConnectionError.Error",
"http2ErrCode.String",
"http2FrameHeader.String",
"http2FrameType.String",
"http2FrameWriteRequest.String",
"http2Framer.ReadFrame",
"http2Framer.ReadFrameForHeader",
"http2Framer.ReadFrameHeader",
"http2Framer.WriteContinuation",
"http2Framer.WriteData",
"http2Framer.WriteDataPadded",
"http2Framer.WriteGoAway",
"http2Framer.WriteHeaders",
"http2Framer.WritePing",
"http2Framer.WritePriority",
"http2Framer.WritePushPromise",
"http2Framer.WriteRSTStream",
"http2Framer.WriteRawFrame",
"http2Framer.WriteSettings",
"http2Framer.WriteSettingsAck",
"http2Framer.WriteWindowUpdate",
"http2GoAwayError.Error",
"http2Server.ServeConn",
"http2Setting.String",
"http2SettingID.String",
"http2SettingsFrame.ForeachSetting",
"http2StreamError.Error",
"http2Transport.CloseIdleConnections",
"http2Transport.NewClientConn",
"http2Transport.RoundTrip",
"http2Transport.RoundTripOpt",
"http2bufferedWriter.Flush",
"http2bufferedWriter.Write",
"http2bufferedWriterTimeoutWriter.Write",
"http2chunkWriter.Write",
"http2clientConnPool.GetClientConn",
"http2connError.Error",
"http2dataBuffer.Read",
"http2duplicatePseudoHeaderError.Error",
"http2gzipReader.Close",
"http2gzipReader.Read",
"http2headerFieldNameError.Error",
"http2headerFieldValueError.Error",
"http2netHTTPClientConn.Close",
"http2netHTTPClientConn.RoundTrip",
"http2noDialClientConnPool.GetClientConn",
"http2noDialH2RoundTripper.NewClientConn",
"http2noDialH2RoundTripper.RoundTrip",
"http2pipe.Read",
"http2priorityWriteSchedulerRFC7540.CloseStream",
"http2priorityWriteSchedulerRFC7540.OpenStream",
"http2priorityWriteSchedulerRFC9218.OpenStream",
"http2pseudoHeaderError.Error",
"http2requestBody.Close",
"http2requestBody.Read",
"http2responseWriter.Flush",
"http2responseWriter.FlushError",
"http2responseWriter.Push",
"http2responseWriter.SetReadDeadline",
"http2responseWriter.SetWriteDeadline",
"http2responseWriter.Write",
"http2responseWriter.WriteHeader",
"http2responseWriter.WriteString",
"http2roundRobinWriteScheduler.OpenStream",
"http2serverConn.CloseConn",
"http2serverConn.Flush",
"http2serverConn.closeStream",
"http2serverConn.handlerDone",
"http2serverConn.newWriterAndRequest",
"http2serverConn.newWriterAndRequestNoBody",
"http2serverConn.noteBodyRead",
"http2serverConn.processHeaders",
"http2serverConn.runHandler",
"http2serverConn.scheduleHandler",
"http2stickyErrWriter.Write",
"http2transportResponseBody.Close",
"http2transportResponseBody.Read",
"http2unencryptedTransport.RoundTrip",
"http2writeData.String",
"initALPNRequest.ServeHTTP",
"loggingConn.Close",
"loggingConn.Read",
"loggingConn.Write",
"maxBytesReader.Close",
"maxBytesReader.Read",
"onceCloseListener.Close",
"persistConn.Read",
"persistConnWriter.ReadFrom",
"persistConnWriter.Write",
"populateResponse.Write",
"populateResponse.WriteHeader",
"readTrackingBody.Close",
"readTrackingBody.Read",
"readWriteCloserBody.CloseWrite",
"readWriteCloserBody.Read",
"redirectHandler.ServeHTTP",
"response.Flush",
"response.FlushError",
"response.Hijack",
"response.ReadFrom",
"response.Write",
"response.WriteHeader",
"response.WriteString",
"serverHandler.ServeHTTP",
"socksDialer.DialWithConn",
"socksUsernamePassword.Authenticate",
"stringWriter.WriteString",
"timeoutHandler.ServeHTTP",
"timeoutWriter.Write",
"timeoutWriter.WriteHeader",
"transportReadFromServerError.Error",
"unencryptedHTTP2Request.ServeHTTP"
]
}
]
}
Go / stdlib
Package
- Name
- stdlib
- View open source insights on deps.dev
- Purl
- pkg:golang/stdlib
Ecosystem specific
{
"imports": [
{
"path": "net/http/internal/http2",
"symbols": [
"Server.ServeConn",
"requestBody.Close",
"requestBody.Read",
"serverConn.closeStream",
"serverConn.handlerDone",
"serverConn.newWriterAndRequest",
"serverConn.newWriterAndRequestNoBody",
"serverConn.noteBodyRead",
"serverConn.processHeaders",
"serverConn.runHandler",
"serverConn.scheduleHandler"
]
}
]
}
Go / golang.org/x/net
Package
- Name
- golang.org/x/net
- View open source insights on deps.dev
- Purl
- pkg:golang/golang.org/x/net
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.60.0
Ecosystem specific
{
"imports": [
{
"path": "golang.org/x/net/http2",
"symbols": [
"ClientConn.Close",
"ClientConn.Ping",
"ClientConn.RoundTrip",
"ClientConn.Shutdown",
"ConfigureServer",
"ConfigureTransport",
"ConfigureTransports",
"ConnectionError.Error",
"ErrCode.String",
"FrameHeader.String",
"FrameType.String",
"FrameWriteRequest.String",
"Framer.ReadFrame",
"Framer.ReadFrameForHeader",
"Framer.ReadFrameHeader",
"Framer.WriteContinuation",
"Framer.WriteData",
"Framer.WriteDataPadded",
"Framer.WriteGoAway",
"Framer.WriteHeaders",
"Framer.WritePing",
"Framer.WritePriority",
"Framer.WritePriorityUpdate",
"Framer.WritePushPromise",
"Framer.WriteRSTStream",
"Framer.WriteRawFrame",
"Framer.WriteSettings",
"Framer.WriteSettingsAck",
"Framer.WriteWindowUpdate",
"GoAwayError.Error",
"ReadFrameHeader",
"Server.ServeConn",
"Setting.String",
"SettingID.String",
"SettingsFrame.ForeachSetting",
"StreamError.Error",
"Transport.CloseIdleConnections",
"Transport.NewClientConn",
"Transport.RoundTrip",
"Transport.RoundTripOpt",
"bufferedWriter.Flush",
"bufferedWriter.Write",
"bufferedWriterTimeoutWriter.Write",
"chunkWriter.Write",
"clientConnPool.GetClientConn",
"connError.Error",
"dataBuffer.Read",
"duplicatePseudoHeaderError.Error",
"gzipReader.Close",
"gzipReader.Read",
"headerFieldNameError.Error",
"headerFieldValueError.Error",
"netHTTPClientConn.Close",
"netHTTPClientConn.RoundTrip",
"noDialClientConnPool.GetClientConn",
"noDialH2RoundTripper.NewClientConn",
"noDialH2RoundTripper.RoundTrip",
"pipe.Read",
"priorityWriteSchedulerRFC7540.CloseStream",
"priorityWriteSchedulerRFC7540.OpenStream",
"priorityWriteSchedulerRFC9218.OpenStream",
"pseudoHeaderError.Error",
"requestBody.Close",
"requestBody.Read",
"responseWriter.Flush",
"responseWriter.FlushError",
"responseWriter.Push",
"responseWriter.SetReadDeadline",
"responseWriter.SetWriteDeadline",
"responseWriter.Write",
"responseWriter.WriteHeader",
"responseWriter.WriteString",
"roundRobinWriteScheduler.OpenStream",
"serverConn.CloseConn",
"serverConn.Flush",
"serverConn.closeStream",
"serverConn.handlerDone",
"serverConn.newWriterAndRequest",
"serverConn.newWriterAndRequestNoBody",
"serverConn.noteBodyRead",
"serverConn.processHeaders",
"serverConn.runHandler",
"serverConn.scheduleHandler",
"stickyErrWriter.Write",
"transportResponseBody.Close",
"transportResponseBody.Read",
"unencryptedTransport.RoundTrip",
"writeData.String"
]
}
]
}