Go standard library net/http/internal/http2
6 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97032 | 1.27.0-0 – < 1.27.2 | HTTP/2 server crash due to HPACK encoder race in net/http | HIGH 7.5 | 0.5 % | ||
| CVE-2026-78669 | 1.27.0-0 – < 1.27.2 | Excessive CPU consumption from repeated initial window changes in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-78663 | 1.27.0-0 – < 1.27.2 | Double flow control refund on HTTP/2 server streams in net/http | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-78660 | 1.27.0-0 – < 1.27.2 | HTTP/2 transport accepts malformed framing-related headers in net/http | HIGH 7.5 | 0.4 % | ||
| CVE-2026-78659 | 1.27.0-0 – < 1.27.2 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-39821 | < 1.25.13 ; 1.26.0-0 – < 1.26.6 ; 1.27.0-0 – < 1.27.0-rc.3 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL 9.6 | 1.8 % |