CVE-2026-78659

A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service (DoS) by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker can exhaust system memory resources and cause the application to crash.

A memory exhaustion flaw was found in Go's net/http package. When an HTTP/2 client sends a "Trailer" header declaring a large number of trailer fields, the server allocates memory for each declared field when populating the Request.Trailer map, bypassing the Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. A remote attacker could exploit this by sending specially crafted HTTP/2 requests to exhaust server memory and cause a denial of service.

This issue only affects applications that operate an HTTP/2 server and process client-supplied trailer headers; HTTP/1 servers are not affected because they do not multiplex requests over a single connection and calculate header limits differently.

This flaw was fixed in Go 1.26.9 and 1.27.2 (net/http), and in golang.org/x/net/http2 v0.60.0 for code using the x/net module.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no configuration-based mitigation for applications that must accept client-supplied trailer headers over HTTP/2. Possible mitigations are:

• Disable HTTP/2 in the affected server (e.g. do not configure http2 via TLSNextProto / do not serve over h2), forcing HTTP/1.1 where the issue does not apply.
• Terminate HTTP/2 at a reverse proxy or load balancer that limits request/header sizes and does not forward excessive trailer declarations to the backend.
• Restrict network access to the HTTP/2 endpoint so that only trusted clients can connect.