EUVD-2026-58510Published
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-56853 · Microsoft / collected KEV context
cve-program · CVE-2026-56853
- https://go.dev/issue/80205
- https://go.dev/cl/795540
- https://groups.google.com/g/golang-announce/c/94pEornpRlI
- https://pkg.go.dev/vuln/GO-2026-6089
euvd · EUVD-2026-58510
- https://go.dev/issue/80205
- https://go.dev/cl/795540
- https://groups.google.com/g/golang-announce/c/94pEornpRlI
- https://pkg.go.dev/vuln/GO-2026-6089
nvd · CVE-2026-56853
- https://go.dev/cl/795540
- https://go.dev/issue/80205
- https://groups.google.com/g/golang-announce/c/94pEornpRlI
- https://pkg.go.dev/vuln/GO-2026-6089
osv · GO-2026-6089
Related operational evidence
Explicit CVE identifiers- When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. · Advisory content revised · 9 Nov 2026
- When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. · Advisory content revised · 7 Nov 2026
- When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. · Advisory content revised · 5 Nov 2026
- When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. · Advisory content revised · 1 Nov 2026