Unrated severityNVD Advisory· Published Aug 13, 2026

CVE-2026-56853

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Affected products

Golang/Gollm-fuzzy

Patches

Vulnerability mechanics

References

go.dev/cl/795540nvd
go.dev/issue/80205nvd
groups.google.com/g/golang-announce/c/94pEornpRlInvd
pkg.go.dev/vuln/GO-2026-6089nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000