Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Go standard library | net/http | unaffected |
|
||||||
| Go standard library | net/http/internal/http2 | unaffected |
|
||||||
| golang.org/x/net | golang.org/x/net/http2 | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 08 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. | |
| Title | HTTP/2 transport accepts malformed framing-related headers in net/http | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2026-10-08T22:53:59.334Z
Reserved: 2026-08-24T23:36:15.738Z
Link: CVE-2026-78660
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-08T23:17:03.510
Modified: 2026-10-08T23:17:03.510
Link: CVE-2026-78660
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.