Repository navigation
net/http: excessive CPU consumption from repeated initial window changes #81742
Description
A malicious HTTP/2 peer could cause excessive CPU consumption in the
client or server by opening a large number of streams and then sending
many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
The HTTP/2 client and server now efficiently handle changes to the
initial window size (O(1) rather than O(number of streams)).
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78669 and Go issue https://go.dev/issue/81742.
This was a PRIVATE track issue originally tracked in http://b/549104372.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81903 (for 1.26), #81904 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847031 mentions this issue:
[release-branch.go1.27] net/http/internal/http2: avoid excessive work on initial window changesgopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847111 mentions this issue:
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes[release-branch.go1.27] net/http/internal/http2: avoid excessive work…
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847308 mentions this issue:
net/http/internal/http2: avoid excessive work on initial window changes[-]security: fix CVE-2026-78669[/-][+]net/http: excessive CPU consumption from repeated initial window changes[/+]net/http/internal/http2: avoid excessive work on initial window changes