net/http: enabling UnencryptedHTTP2 on Server disables first header read timeout

[neild]

When a server is configured to support unencrypted HTTP/2, it reads a
few bytes from each new connection to see if they contain the HTTP/2
client preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.

This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.

---

This was a PUBLIC track issue, tracked in http://b/521889673.

[gopherbot]

Change https://go.dev/cl/795540 mentions this issue: net/http: apply header timeout to server's unencrypted HTTP/2 check

[neild]

Thanks to Vsevolod Naumov and Ainar Garipov from AdGuard for reporting this issue.

[ainar-g]

@neild, thanks again for fixing this! Can we expect this to be backported to the 1.26 branch?

(Also, I'm not sure if the OS-Windows label is fitting.)

[neild]

@gopherbot please open backport issues for this security fix.

[gopherbot]

Backport issue(s) opened: #80223 (for 1.25), #80224 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[neild]

@ainar-g Yes, this will be backported. I think it's missed the train for the next set of minor releases, so probably in the ones after that.

[neild]

Temporarily reverting fix on master, landed too close to the rc2 cutoff. Will miss rc2 and the upcoming minors, will land in rc3/1.27 and the following minors.