Repository navigation
net/http: double flow control refund on HTTP/2 server streams #81743
Description
The HTTP/2 server could refund connection-level flow control twice for the same data:
Once when a client resets a stream (refunding data for any sent-but-unread portion
of the stream), and again when a request handler reads the buffered data.
A malicious client could exploit this to bypass the configured connection-level
flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still
limited by the concurrent stream limit and stream-level flow control.
The HTTP/2 server now waits to refund connection-level flow control for reset
streams until after the request handler is complete.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/) for reporting this issue.
This is CVE-2026-78663 and Go issue https://go.dev/issue/81743.
This was a PRIVATE track issue originally tracked in http://b/549709976.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81905 (for 1.26), #81906 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847032 mentions this issue:
[release-branch.go1.27] net/http/internal/http2: avoid 2x refund on stream close with buffered datagopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847111 mentions this issue:
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes[release-branch.go1.27] net/http/internal/http2: avoid 2x refund on s…
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847310 mentions this issue:
net/http/internal/http2: avoid 2x refund on stream close with buffered data[-]security: fix CVE-2026-78663[/-][+]net/http: double flow control refund on HTTP/2 server streams[/+]net/http/internal/http2: avoid 2x refund on stream close with buffere…