Product by Go Standard Library
Net/http/internal/http2
6 known vulnerabilities in Net/http/internal/http2 (Go Standard Library), 0 of them actively exploited (CISA KEV).
Key figures
6
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | |
| High | CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | 7.5 | |
| High | CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | 7.5 | |
| High | CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | 7.5 | |
| High | CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | 7.5 | |
| Medium | CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | 5.9 |