{"id":"CVE-2026-97032","revision":"20fea5a048ba4fda9bb40cb50ef19812","records":[{"revision":"20fea5a048ba4fda9bb40cb50ef19812","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97032","aliases":[],"title":"HTTP/2 server crash due to HPACK encoder race in net/http","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","state":0,"publishedAt":"2026-10-08T22:54:00.23+00:00","modifiedAt":"2026-10-15T15:46:39.417+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"net/http","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"net/http\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"net/http\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.26.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"http2serverConn.processSetting\"\n                        },\n                        {\n                            \"name\": \"http2serverConn.startFrameWrite\"\n                        },\n                        {\n                            \"name\": \"CanonicalHeaderKey\"\n                        },\n                        {\n                            \"name\": \"Client.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"Client.Do\"\n                        },\n                        {\n                            \"name\": \"Client.Get\"\n                        },\n                        {\n                            \"name\": \"Client.Head\"\n                        },\n                        {\n                            \"name\": \"Client.Post\"\n                        },\n                        {\n                            \"name\": \"Client.PostForm\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"Cookie.String\"\n                        },\n                        {\n                            \"name\": \"Cookie.Valid\"\n                        },\n                        {\n                            \"name\": \"CrossOriginProtection.AddInsecureBypassPattern\"\n                        },\n                        {\n                            \"name\": \"CrossOriginProtection.AddTrustedOrigin\"\n                        },\n                        {\n                            \"name\": \"CrossOriginProtection.Check\"\n                        },\n                        {\n                            \"name\": \"Dir.Open\"\n                        },\n                        {\n                            \"name\": \"Error\"\n                        },\n                        {\n                            \"name\": \"Get\"\n                        },\n                        {\n                            \"name\": \"Handle\"\n                        },\n                        {\n                            \"name\": \"HandleFunc\"\n                        },\n                        {\n                            \"name\": \"HandlerFunc.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"Head\"\n                        },\n                        {\n                            \"name\": \"Header.Add\"\n                        },\n                        {\n                            \"name\": \"Header.Del\"\n                        },\n                        {\n                            \"name\": \"Header.Get\"\n                        },\n                        {\n                            \"name\": \"Header.Set\"\n                        },\n                        {\n                            \"name\": \"Header.Values\"\n                        },\n                        {\n                            \"name\": \"Header.Write\"\n                        },\n                        {\n                            \"name\": \"Header.WriteSubset\"\n                        },\n                        {\n                            \"name\": \"ListenAndServe\"\n                        },\n                        {\n                            \"name\": \"ListenAndServeTLS\"\n                        },\n                        {\n                            \"name\": \"NewRequest\"\n                        },\n                        {\n                            \"name\": \"NewRequestWithContext\"\n                        },\n                        {\n                            \"name\": \"NotFound\"\n                        },\n                        {\n                            \"name\": \"ParseCookie\"\n                        },\n                        {\n                            \"name\": \"ParseSetCookie\"\n                        },\n                        {\n                            \"name\": \"ParseTime\"\n                        },\n                        {\n                            \"name\": \"Post\"\n                        },\n                        {\n                            \"name\": \"PostForm\"\n                        },\n                        {\n                            \"name\": \"ProxyFromEnvironment\"\n                        },\n                        {\n                            \"name\": \"ReadRequest\"\n                        },\n                        {\n                            \"name\": \"ReadResponse\"\n                        },\n                        {\n                            \"name\": \"Redirect\"\n                        },\n                        {\n                            \"name\": \"Request.AddCookie\"\n                        },\n                        {\n                            \"name\": \"Request.BasicAuth\"\n                        },\n                        {\n                            \"name\": \"Request.Cookie\"\n                        },\n                        {\n                            \"name\": \"Request.Cookies\"\n                        },\n                        {\n                            \"name\": \"Request.CookiesNamed\"\n                        },\n                        {\n                            \"name\": \"Request.FormFile\"\n                        },\n                        {\n                            \"name\": \"Request.FormValue\"\n                        },\n                        {\n                            \"name\": \"Request.MultipartReader\"\n                        },\n                        {\n                            \"name\": \"Request.ParseForm\"\n                        },\n                        {\n                            \"name\": \"Request.ParseMultipartForm\"\n                        },\n                        {\n                            \"name\": \"Request.PostFormValue\"\n                        },\n                        {\n                            \"name\": \"Request.Referer\"\n                        },\n                        {\n                            \"name\": \"Request.SetBasicAuth\"\n                        },\n                        {\n                            \"name\": \"Request.UserAgent\"\n                        },\n                        {\n                            \"name\": \"Request.Write\"\n                        },\n                        {\n                            \"name\": \"Request.WriteProxy\"\n                        },\n                        {\n                            \"name\": \"Response.Cookies\"\n                        },\n                        {\n                            \"name\": \"Response.Location\"\n                        },\n                        {\n                            \"name\": \"Response.Write\"\n                        },\n                        {\n                            \"name\": \"ResponseController.EnableFullDuplex\"\n                        },\n                        {\n                            \"name\": \"ResponseController.Flush\"\n                        },\n                        {\n                            \"name\": \"ResponseController.Hijack\"\n                        },\n                        {\n                            \"name\": \"ResponseController.SetReadDeadline\"\n                        },\n                        {\n                            \"name\": \"ResponseController.SetWriteDeadline\"\n                        },\n                        {\n                            \"name\": \"Serve\"\n                        },\n                        {\n                            \"name\": \"ServeContent\"\n                        },\n                        {\n                            \"name\": \"ServeFile\"\n                        },\n                        {\n                            \"name\": \"ServeFileFS\"\n                        },\n                        {\n                            \"name\": \"ServeMux.Handle\"\n                        },\n                        {\n                            \"name\": \"ServeMux.HandleFunc\"\n                        },\n                        {\n                            \"name\": \"ServeMux.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"ServeTLS\"\n                        },\n                        {\n                            \"name\": \"Server.Close\"\n                        },\n                        {\n                            \"name\": \"Server.ListenAndServe\"\n                        },\n                        {\n                            \"name\": \"Server.ListenAndServeTLS\"\n                        },\n                        {\n                            \"name\": \"Server.Serve\"\n                        },\n                        {\n                            \"name\": \"Server.ServeTLS\"\n                        },\n                        {\n                            \"name\": \"Server.SetKeepAlivesEnabled\"\n                        },\n                        {\n                            \"name\": \"Server.Shutdown\"\n                        },\n                        {\n                            \"name\": \"SetCookie\"\n                        },\n                        {\n                            \"name\": \"Transport.CancelRequest\"\n                        },\n                        {\n                            \"name\": \"Transport.Clone\"\n                        },\n                        {\n                            \"name\": \"Transport.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"Transport.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"Transport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"body.Close\"\n                        },\n                        {\n                            \"name\": \"body.Read\"\n                        },\n                        {\n                            \"name\": \"bodyEOFSignal.Close\"\n                        },\n                        {\n                            \"name\": \"bodyEOFSignal.Read\"\n                        },\n                        {\n                            \"name\": \"bodyLocked.Read\"\n                        },\n                        {\n                            \"name\": \"bufioFlushWriter.Write\"\n                        },\n                        {\n                            \"name\": \"cancelTimerBody.Close\"\n                        },\n                        {\n                            \"name\": \"cancelTimerBody.Read\"\n                        },\n                        {\n                            \"name\": \"checkConnErrorWriter.Write\"\n                        },\n                        {\n                            \"name\": \"chunkWriter.Write\"\n                        },\n                        {\n                            \"name\": \"connReader.Read\"\n                        },\n                        {\n                            \"name\": \"connectMethodKey.String\"\n                        },\n                        {\n                            \"name\": \"expectContinueReader.Close\"\n                        },\n                        {\n                            \"name\": \"expectContinueReader.Read\"\n                        },\n                        {\n                            \"name\": \"extraHeader.Write\"\n                        },\n                        {\n                            \"name\": \"fileHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"fileTransport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"globalOptionsHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Close\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Read\"\n                        },\n                        {\n                            \"name\": \"http1ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"http1ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"http2ClientConn.Ping\"\n                        },\n                        {\n                            \"name\": \"http2ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2ClientConn.Shutdown\"\n                        },\n                        {\n                            \"name\": \"http2ConnectionError.Error\"\n                        },\n                        {\n                            \"name\": \"http2ErrCode.String\"\n                        },\n                        {\n                            \"name\": \"http2FrameHeader.String\"\n                        },\n                        {\n                            \"name\": \"http2FrameType.String\"\n                        },\n                        {\n                            \"name\": \"http2FrameWriteRequest.String\"\n                        },\n                        {\n                            \"name\": \"http2Framer.ReadFrame\"\n                        },\n                        {\n                            \"name\": \"http2Framer.ReadFrameForHeader\"\n                        },\n                        {\n                            \"name\": \"http2Framer.ReadFrameHeader\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteContinuation\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteData\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteDataPadded\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteGoAway\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteHeaders\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WritePing\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WritePriority\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WritePushPromise\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteRSTStream\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteRawFrame\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteSettings\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteSettingsAck\"\n                        },\n                        {\n                            \"name\": \"http2Framer.WriteWindowUpdate\"\n                        },\n                        {\n                            \"name\": \"http2GoAwayError.Error\"\n                        },\n                        {\n                            \"name\": \"http2Server.ServeConn\"\n                        },\n                        {\n                            \"name\": \"http2Setting.String\"\n                        },\n                        {\n                            \"name\": \"http2SettingID.String\"\n                        },\n                        {\n                            \"name\": \"http2SettingsFrame.ForeachSetting\"\n                        },\n                        {\n                            \"name\": \"http2StreamError.Error\"\n                        },\n                        {\n                            \"name\": \"http2Transport.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"http2Transport.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"http2Transport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2Transport.RoundTripOpt\"\n                        },\n                        {\n                            \"name\": \"http2bufferedWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"http2bufferedWriter.Write\"\n                        },\n                        {\n                            \"name\": \"http2bufferedWriterTimeoutWriter.Write\"\n                        },\n                        {\n                            \"name\": \"http2chunkWriter.Write\"\n                        },\n                        {\n                            \"name\": \"http2clientConnPool.GetClientConn\"\n                        },\n                        {\n                            \"name\": \"http2connError.Error\"\n                        },\n                        {\n                            \"name\": \"http2dataBuffer.Read\"\n                        },\n                        {\n                            \"name\": \"http2duplicatePseudoHeaderError.Error\"\n                        },\n                        {\n                            \"name\": \"http2gzipReader.Close\"\n                        },\n                        {\n                            \"name\": \"http2gzipReader.Read\"\n                        },\n                        {\n                            \"name\": \"http2headerFieldNameError.Error\"\n                        },\n                        {\n                            \"name\": \"http2headerFieldValueError.Error\"\n                        },\n                        {\n                            \"name\": \"http2netHTTPClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"http2netHTTPClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2noDialClientConnPool.GetClientConn\"\n                        },\n                        {\n                            \"name\": \"http2noDialH2RoundTripper.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"http2noDialH2RoundTripper.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2pipe.Read\"\n                        },\n                        {\n                            \"name\": \"http2priorityWriteSchedulerRFC7540.CloseStream\"\n                        },\n                        {\n                            \"name\": \"http2priorityWriteSchedulerRFC7540.OpenStream\"\n                        },\n                        {\n                            \"name\": \"http2priorityWriteSchedulerRFC9218.OpenStream\"\n                        },\n                        {\n                            \"name\": \"http2pseudoHeaderError.Error\"\n                        },\n                        {\n                            \"name\": \"http2requestBody.Close\"\n                        },\n                        {\n                            \"name\": \"http2requestBody.Read\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.FlushError\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.Push\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.SetReadDeadline\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.SetWriteDeadline\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.Write\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"http2responseWriter.WriteString\"\n                        },\n                        {\n                            \"name\": \"http2roundRobinWriteScheduler.OpenStream\"\n                        },\n                        {\n                            \"name\": \"http2serverConn.CloseConn\"\n                        },\n                        {\n                            \"name\": \"http2serverConn.Flush\"\n                        },\n                        {\n                            \"name\": \"http2stickyErrWriter.Write\"\n                        },\n                        {\n                            \"name\": \"http2transportResponseBody.Close\"\n                        },\n                        {\n                            \"name\": \"http2transportResponseBody.Read\"\n                        },\n                        {\n                            \"name\": \"http2unencryptedTransport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"http2writeData.String\"\n                        },\n                        {\n                            \"name\": \"initALPNRequest.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"loggingConn.Close\"\n                        },\n                        {\n                            \"name\": \"loggingConn.Read\"\n                        },\n                        {\n                            \"name\": \"loggingConn.Write\"\n                        },\n                        {\n                            \"name\": \"maxBytesReader.Close\"\n                        },\n                        {\n                            \"name\": \"maxBytesReader.Read\"\n                        },\n                        {\n                            \"name\": \"onceCloseListener.Close\"\n                        },\n                        {\n                            \"name\": \"persistConn.Read\"\n                        },\n                        {\n                            \"name\": \"persistConnWriter.ReadFrom\"\n                        },\n                        {\n                            \"name\": \"persistConnWriter.Write\"\n                        },\n                        {\n                            \"name\": \"populateResponse.Write\"\n                        },\n                        {\n                            \"name\": \"populateResponse.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"readTrackingBody.Close\"\n                        },\n                        {\n                            \"name\": \"readTrackingBody.Read\"\n                        },\n                        {\n                            \"name\": \"readWriteCloserBody.CloseWrite\"\n                        },\n                        {\n                            \"name\": \"readWriteCloserBody.Read\"\n                        },\n                        {\n                            \"name\": \"redirectHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"response.Flush\"\n                        },\n                        {\n                            \"name\": \"response.FlushError\"\n                        },\n                        {\n                            \"name\": \"response.Hijack\"\n                        },\n                        {\n                            \"name\": \"response.ReadFrom\"\n                        },\n                        {\n                            \"name\": \"response.Write\"\n                        },\n                        {\n                            \"name\": \"response.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"response.WriteString\"\n                        },\n                        {\n                            \"name\": \"serverHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"socksDialer.DialWithConn\"\n                        },\n                        {\n                            \"name\": \"socksUsernamePassword.Authenticate\"\n                        },\n                        {\n                            \"name\": \"stringWriter.WriteString\"\n                        },\n                        {\n                            \"name\": \"timeoutHandler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"timeoutWriter.Write\"\n                        },\n                        {\n                            \"name\": \"timeoutWriter.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"transportReadFromServerError.Error\"\n                        },\n                        {\n                            \"name\": \"unencryptedHTTP2Request.ServeHTTP\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://pkg.go.dev","name":"net/http/internal/http2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"net/http/internal/http2\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"net/http/internal/http2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.27.0-0\",\n                            \"lessThan\": \"1.27.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"serverConn.processSetting\"\n                        },\n                        {\n                            \"name\": \"serverConn.startFrameWrite\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Ping\"\n                        },\n                        {\n                            \"name\": \"ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Shutdown\"\n                        },\n                        {\n                            \"name\": \"Framer.ReadFrame\"\n                        },\n                        {\n                            \"name\": \"Framer.ReadFrameForHeader\"\n                        },\n                        {\n                            \"name\": \"Framer.ReadFrameHeader\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteContinuation\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteData\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteDataPadded\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteGoAway\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteHeaders\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePing\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePriority\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePriorityUpdate\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePushPromise\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteRSTStream\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteRawFrame\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteSettings\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteSettingsAck\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteWindowUpdate\"\n                        },\n                        {\n                            \"name\": \"NetHTTPClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"NetHTTPClientConn.Ping\"\n                        },\n                        {\n                            \"name\": \"NetHTTPClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"ReadFrameHeader\"\n                        },\n                        {\n                            \"name\": \"Server.GracefulShutdown\"\n                        },\n                        {\n                            \"name\": \"Server.ServeConn\"\n                        },\n                        {\n                            \"name\": \"SettingsFrame.ForeachSetting\"\n                        },\n                        {\n                            \"name\": \"Transport.AddConn\"\n                        },\n                        {\n                            \"name\": \"Transport.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"Transport.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"Transport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"Transport.RoundTripOpt\"\n                        },\n                        {\n                            \"name\": \"bufferedWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"bufferedWriter.Write\"\n                        },\n                        {\n                            \"name\": \"bufferedWriterTimeoutWriter.Write\"\n                        },\n                        {\n                            \"name\": \"chunkWriter.Write\"\n                        },\n                        {\n                            \"name\": \"clientConnPool.GetClientConn\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Close\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Read\"\n                        },\n                        {\n                            \"name\": \"noDialClientConnPool.GetClientConn\"\n                        },\n                        {\n                            \"name\": \"requestBody.Close\"\n                        },\n                        {\n                            \"name\": \"responseWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"responseWriter.FlushError\"\n                        },\n                        {\n                            \"name\": \"responseWriter.Push\"\n                        },\n                        {\n                            \"name\": \"responseWriter.Write\"\n                        },\n                        {\n                            \"name\": \"responseWriter.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"responseWriter.WriteString\"\n                        },\n                        {\n                            \"name\": \"serve400Handler.ServeHTTP\"\n                        },\n                        {\n                            \"name\": \"serverConn.Flush\"\n                        },\n                        {\n                            \"name\": \"stickyErrWriter.Write\"\n                        },\n                        {\n                            \"name\": \"transportResponseBody.Close\"\n                        },\n                        {\n                            \"name\": \"transportResponseBody.Read\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://pkg.go.dev","name":"golang.org/x/net/http2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"golang.org/x/net\",\n                    \"product\": \"golang.org/x/net/http2\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"golang.org/x/net/http2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.60.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"serverConn.processSetting\"\n                        },\n                        {\n                            \"name\": \"serverConn.startFrameWrite\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Ping\"\n                        },\n                        {\n                            \"name\": \"ClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"ClientConn.Shutdown\"\n                        },\n                        {\n                            \"name\": \"ConfigureServer\"\n                        },\n                        {\n                            \"name\": \"ConfigureTransport\"\n                        },\n                        {\n                            \"name\": \"ConfigureTransports\"\n                        },\n                        {\n                            \"name\": \"ConnectionError.Error\"\n                        },\n                        {\n                            \"name\": \"ErrCode.String\"\n                        },\n                        {\n                            \"name\": \"FrameHeader.String\"\n                        },\n                        {\n                            \"name\": \"FrameType.String\"\n                        },\n                        {\n                            \"name\": \"FrameWriteRequest.String\"\n                        },\n                        {\n                            \"name\": \"Framer.ReadFrame\"\n                        },\n                        {\n                            \"name\": \"Framer.ReadFrameForHeader\"\n                        },\n                        {\n                            \"name\": \"Framer.ReadFrameHeader\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteContinuation\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteData\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteDataPadded\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteGoAway\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteHeaders\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePing\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePriority\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePriorityUpdate\"\n                        },\n                        {\n                            \"name\": \"Framer.WritePushPromise\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteRSTStream\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteRawFrame\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteSettings\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteSettingsAck\"\n                        },\n                        {\n                            \"name\": \"Framer.WriteWindowUpdate\"\n                        },\n                        {\n                            \"name\": \"GoAwayError.Error\"\n                        },\n                        {\n                            \"name\": \"ReadFrameHeader\"\n                        },\n                        {\n                            \"name\": \"Server.ServeConn\"\n                        },\n                        {\n                            \"name\": \"Setting.String\"\n                        },\n                        {\n                            \"name\": \"SettingID.String\"\n                        },\n                        {\n                            \"name\": \"SettingsFrame.ForeachSetting\"\n                        },\n                        {\n                            \"name\": \"StreamError.Error\"\n                        },\n                        {\n                            \"name\": \"Transport.CloseIdleConnections\"\n                        },\n                        {\n                            \"name\": \"Transport.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"Transport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"Transport.RoundTripOpt\"\n                        },\n                        {\n                            \"name\": \"bufferedWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"bufferedWriter.Write\"\n                        },\n                        {\n                            \"name\": \"bufferedWriterTimeoutWriter.Write\"\n                        },\n                        {\n                            \"name\": \"chunkWriter.Write\"\n                        },\n                        {\n                            \"name\": \"clientConnPool.GetClientConn\"\n                        },\n                        {\n                            \"name\": \"connError.Error\"\n                        },\n                        {\n                            \"name\": \"dataBuffer.Read\"\n                        },\n                        {\n                            \"name\": \"duplicatePseudoHeaderError.Error\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Close\"\n                        },\n                        {\n                            \"name\": \"gzipReader.Read\"\n                        },\n                        {\n                            \"name\": \"headerFieldNameError.Error\"\n                        },\n                        {\n                            \"name\": \"headerFieldValueError.Error\"\n                        },\n                        {\n                            \"name\": \"netHTTPClientConn.Close\"\n                        },\n                        {\n                            \"name\": \"netHTTPClientConn.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"noDialClientConnPool.GetClientConn\"\n                        },\n                        {\n                            \"name\": \"noDialH2RoundTripper.NewClientConn\"\n                        },\n                        {\n                            \"name\": \"noDialH2RoundTripper.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"pipe.Read\"\n                        },\n                        {\n                            \"name\": \"priorityWriteSchedulerRFC7540.CloseStream\"\n                        },\n                        {\n                            \"name\": \"priorityWriteSchedulerRFC7540.OpenStream\"\n                        },\n                        {\n                            \"name\": \"priorityWriteSchedulerRFC9218.OpenStream\"\n                        },\n                        {\n                            \"name\": \"pseudoHeaderError.Error\"\n                        },\n                        {\n                            \"name\": \"requestBody.Close\"\n                        },\n                        {\n                            \"name\": \"requestBody.Read\"\n                        },\n                        {\n                            \"name\": \"responseWriter.Flush\"\n                        },\n                        {\n                            \"name\": \"responseWriter.FlushError\"\n                        },\n                        {\n                            \"name\": \"responseWriter.Push\"\n                        },\n                        {\n                            \"name\": \"responseWriter.SetReadDeadline\"\n                        },\n                        {\n                            \"name\": \"responseWriter.SetWriteDeadline\"\n                        },\n                        {\n                            \"name\": \"responseWriter.Write\"\n                        },\n                        {\n                            \"name\": \"responseWriter.WriteHeader\"\n                        },\n                        {\n                            \"name\": \"responseWriter.WriteString\"\n                        },\n                        {\n                            \"name\": \"roundRobinWriteScheduler.OpenStream\"\n                        },\n                        {\n                            \"name\": \"serverConn.CloseConn\"\n                        },\n                        {\n                            \"name\": \"serverConn.Flush\"\n                        },\n                        {\n                            \"name\": \"stickyErrWriter.Write\"\n                        },\n                        {\n                            \"name\": \"transportResponseBody.Close\"\n                        },\n                        {\n                            \"name\": \"transportResponseBody.Read\"\n                        },\n                        {\n                            \"name\": \"unencryptedTransport.RoundTrip\"\n                        },\n                        {\n                            \"name\": \"writeData.String\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97032","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97032","identifiers":["CVE-2026-97032"]},"retained":false,"historicalAffected":[]}],"coverage":[]}