CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.

This flaw is rated with a Moderate severity for Red Hat products because, although remotely triggerable without authentication, successful exploitation relies on winning a race condition and causes only a denial of service without compromising system confidentiality or integrity. Within Red Hat environments, exposure is limited to network services and server applications built with the Go runtime that actively handle HTTP/2 connections. Applications communicating strictly over HTTP/1.1 or where client connections do not modify header compression parameters are not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients.

For applications managed by systemd, configure the environment variable by creating a service override:

systemctl edit <service-name>

Add the following lines under the [Service] section:

[Service] Environment="GODEBUG=http2server=0"

Apply the changes and restart the daemon:

systemctl daemon-reload systemctl restart <service-name>

To limit network exposure using firewalld, restrict access to trusted networks:

firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload

Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC.

Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability.