[ Vendor · 5 CVEs ]
golang.org/x/net
CVEs affecting golang.org/x/net published in the last 30 days, plus any golang.org/x/net CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-97032 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpHTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the… | |
| CVE-2026-78669 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpA malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small… | |
| CVE-2026-78659 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the… | |
| CVE-2026-78660 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpHistorically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2… | |
| CVE-2026-78663 | 8 Oct 2026 | CVSS 9.1 | Go standard library net/httpThe HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any… |