Product by Go Standard Library
Net/http
26 known vulnerabilities in Net/http (Go Standard Library), 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-45288 | HTTP/2 CONTINUATION flood in net/http | 7.5 | |
| Critical | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | |
| High | CVE-2022-41723 | Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net | 7.5 | |
| High | CVE-2023-39325 | HTTP/2 rapid reset can cause excessive work in net/http | 7.5 | |
| Medium | CVE-2022-41717 | Excessive memory growth in net/http and golang.org/x/net/http2 | 5.3 | |
| High | CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | 7.5 | |
| High | CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | 7.5 | |
| High | CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | 7.5 | |
| High | CVE-2024-24791 | Denial of service due to improper 100-continue handling in net/http | 7.5 | |
| High | CVE-2026-33814 | Golang.org/x/net/http2: Infinite Loop | 7.5 | |
| High | CVE-2026-78667 | Lack of limit on size of parsed Range headers in net/http | 7.5 | |
| High | CVE-2026-56866 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | 7.5 | |
| Medium | CVE-2023-29406 | Insufficient sanitization of Host header in net/http | 6.5 | |
| High | CVE-2026-56853 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http | 7.5 | |
| High | CVE-2022-41720 | Restricted file access on Windows in os and net/http | 7.5 | |
| Medium | CVE-2022-1705 | Improper sanitization of Transfer-Encoding headers in net/http | 6.5 | |
| High | CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | 7.5 | |
| Medium | CVE-2022-32148 | Exposure of client IP addresses in net/http | 6.5 | |
| High | CVE-2026-94439 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | 7.5 | |
| Medium | CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | 5.9 | |
| Medium | CVE-2025-4673 | Sensitive headers not cleared on cross-origin redirect in net/http | 6.8 | |
| Medium | CVE-2024-45336 | Sensitive headers incorrectly sent after cross-domain redirect in net/http | 6.1 | |
| Medium | CVE-2023-45289 | Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http | 4.3 | |
| Medium | CVE-2025-58186 | Lack of limit when parsing cookies can cause memory exhaustion in net/http | 5.3 | |
| Medium | CVE-2025-22870 | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | 4.4 |