Unrated severityNVD Advisory· Published Oct 8, 2026

CVE-2026-78669

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Affected products

Golang/Gollm-fuzzy

Patches

Vulnerability mechanics

References

go.dev/cl/847186nvd
go.dev/cl/847308nvd
go.dev/issue/81742nvd
groups.google.com/g/golang-announce/c/U2fTuyDJznInvd
groups.google.com/g/golang-announce/c/ZPwCyRUuGBsnvd
pkg.go.dev/vuln/GO-2026-6611nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000