CVE-2026-78660

A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this flaw by sending malformed response headers, resulting in HTTP response smuggling, where message boundaries between the proxy and client become desynchronized. This issue may allow attackers to bypass security controls, poison web caches, or intercept sensitive data from other user sessions.

Red Hat has determined that this vulnerability affects products that use the Go net/http HTTP/2 implementation as a reverse proxy between an upstream server and an HTTP/1 client. Exploitation requires a malicious or compromised upstream server to send malformed framing-related response headers. Successful exploitation may allow HTTP response smuggling, which can bypass security controls or affect the integrity and confidentiality of proxied traffic. Red Hat is addressing affected products through the applicable security updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until the applicable security update is installed, avoid using affected Go-based reverse proxies to forward responses from untrusted upstream servers to HTTP/1 clients. Where this topology is required, restrict upstream connections to trusted servers and use a proxy or filtering layer that rejects malformed HTTP framing-related response headers. Apply the relevant Red Hat security update and restart or redeploy affected services.