Repository navigation
security: fix CVE-2026-78659 #81857
Description
net/http: HTTP/2 server memory exhaustion due to Trailer headers
When "Trailer" headers are sent by a client, the HTTP server internally
uses the header values to populate the Request.Trailer map passed to the
server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this
by sending a "Trailer" header that declares a large number of fields,
causing the server to allocate a disproportionate amount of memory while
bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support
multiplexing a large number of requests over one TCP connection, and
whose Server.MaxHeaderBytes are calculated differently.
Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits are now
applied towards the trailer fields declared in "Trailer" headers.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-78659 and Go issue https://go.dev/issue/81857.
This was a PRIVATE track issue originally tracked in http://b/540180564.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81917 (for 1.26), #81918 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847034 mentions this issue:
[internal-release-branch.go1.27.2] net/http: apply header limits to Trailer headers toogopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847034 mentions this issue:
[release-branch.go1.27] net/http: apply header limits to Trailer headers toogopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847111 mentions this issue:
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes[release-branch.go1.27] net/http: apply header limits to Trailer head…
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847185 mentions this issue:
http2: apply header limits to Trailer headers toogopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847314 mentions this issue:
net/http: apply header limits to Trailer headers toonet/http: apply header limits to Trailer headers too
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847352 mentions this issue:
[internal-branch.go1.26-vendor] http2: apply header limits to Trailer headers too[internal-branch.go1.26-vendor] http2: apply header limits to Trailer…
http2: apply header limits to Trailer headers too