Go standard library net/http
26 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97032 | < 1.26.9 | HTTP/2 server crash due to HPACK encoder race in net/http | HIGH 7.5 | 0.5 % | ||
| CVE-2026-94439 | < 1.26.9 ; 1.27.0-0 – < 1.27.2 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | HIGH 7.5 | 0.4 % | ||
| CVE-2026-78669 | < 1.26.9 | Excessive CPU consumption from repeated initial window changes in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-78667 | < 1.26.9 ; 1.27.0-0 – < 1.27.2 | Lack of limit on size of parsed Range headers in net/http | HIGH 7.5 | 0.5 % | ||
| CVE-2026-78663 | < 1.26.9 | Double flow control refund on HTTP/2 server streams in net/http | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-78660 | < 1.26.9 | HTTP/2 transport accepts malformed framing-related headers in net/http | HIGH 7.5 | 0.4 % | ||
| CVE-2026-78659 | < 1.26.9 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-56866 | < 1.26.9 ; 1.27.0-0 – < 1.27.2 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | HIGH 7.5 | 0.5 % | ||
| CVE-2026-56853 | < 1.25.13 ; 1.26.0-0 – < 1.26.6 ; 1.27.0-0 – < 1.27.0-rc.3 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-39821 | < 1.25.13 ; 1.26.0-0 – < 1.26.6 ; 1.27.0-0 – < 1.27.0-rc.3 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL 9.6 | 1.8 % | ||
| CVE-2026-33814 | < 1.25.10 ; 1.26.0-0 – < 1.26.3 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net | HIGH 7.5 | 0.8 % | ||
| CVE-2025-58186 | < 1.24.8 ; 1.25.0 – < 1.25.2 | Lack of limit when parsing cookies can cause memory exhaustion in net/http | MEDIUM 5.3 | 0.6 % | ||
| CVE-2025-47910 | 1.25.0 – < 1.25.1 | CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http | MEDIUM 5.4 | 0.3 % | ||
| CVE-2025-4673 | < 1.23.10 ; 1.24.0-0 – < 1.24.4 | Sensitive headers not cleared on cross-origin redirect in net/http | MEDIUM 6.8 | 0.7 % | ||
| CVE-2025-22870 | < 1.23.7 ; 1.24.0-0 – < 1.24.1 | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | MEDIUM 4.4 | 0.4 % | ||
| CVE-2024-45336 | < 1.22.11 ; 1.23.0-0 – < 1.23.5 ; 1.24.0-0 – < 1.24.0-rc.2 | Sensitive headers incorrectly sent after cross-domain redirect in net/http | MEDIUM 6.1 | 0.7 % | ||
| CVE-2024-24791 | < 1.21.12 ; 1.22.0-0 – < 1.22.5 | Denial of service due to improper 100-continue handling in net/http | HIGH 7.5 | 1.4 % | ||
| CVE-2023-45288 | < 1.21.9 ; 1.22.0-0 – < 1.22.2 | HTTP/2 CONTINUATION flood in net/http | HIGH 7.5 | 92 % | ||
| CVE-2023-45289 | < 1.21.8 ; 1.22.0-0 – < 1.22.1 | Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http | MEDIUM 4.3 | 1.1 % | ||
| CVE-2023-39325 | < 1.20.10 ; 1.21.0-0 – < 1.21.3 | HTTP/2 rapid reset can cause excessive work in net/http | HIGH 7.5 | 3.8 % | ||
| CVE-2023-29406 | < 1.19.11 ; 1.20.0-0 – < 1.20.6 | Insufficient sanitization of Host header in net/http | MEDIUM 6.5 | 1.5 % | ||
| CVE-2022-41723 | < 1.19.6 ; 1.20.0-0 – < 1.20.1 | Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net | HIGH 7.5 | 4.6 % | ||
| CVE-2022-41717 | < 1.18.9 ; 1.19.0-0 – < 1.19.4 | Excessive memory growth in net/http and golang.org/x/net/http2 | MEDIUM 5.3 | 6.1 % | ||
| CVE-2022-41720 | < 1.18.9 ; 1.19.0-0 – < 1.19.4 | Restricted file access on Windows in os and net/http | HIGH 7.5 | 1.3 % | ||
| CVE-2022-32148 | < 1.17.12 ; 1.18.0-0 – < 1.18.4 | Exposure of client IP addresses in net/http | MEDIUM 6.5 | 1.5 % | ||
| CVE-2022-1705 | < 1.17.12 ; 1.18.0-0 – < 1.18.4 | Improper sanitization of Transfer-Encoding headers in net/http | MEDIUM 6.5 | 1.5 % |