Vulnerability GO-2026-6089

Unknown

1 month ago

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

<1.25.13

Summary

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Details

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

1 month ago

Enforce maximum recursion depth in encoding/asn1

<1.25.13 GO-2026-5972

Unknown

1 month ago

Add recursion depth guard during decode in encoding/xml

<1.25.13 GO-2026-6088

Unknown

1 month ago

Limit handshake messages we are willing to accept post-handshake in crypto/tls

<1.25.13 GO-2026-6090

Unknown

1 month ago

Fix Javascript regexp context tracking in html/template

<1.25.13 GO-2026-6091

Unknown

1 month ago

Avoid quadratic complexity in resolvePath in net/url

<1.25.13 GO-2026-6218

View all vulnerabilities for these packages

Impacted packages

stdlib

Timeline

Published

1 month ago

Last Modified

4 days ago