Repository navigation
security: fix CVE-2026-97032 #81867
Description
net/http: HTTP/2 server crash due to HPACK encoder race
HTTP/2 servers could end up crashing due to inadvertently
modifying its HPACK encoder concurrently. This happens because the
server modifies the HPACK encoder from two goroutines without
synchronization: one uses the encoder to encode a HEADERS frame as part
of a response sent to a client and the other modifies the encoder's
table size when handling a SETTINGS frame containing
SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can
repeatedly send a request while changing the header table size to crash
the server.
Fix this issue by not applying SETTINGS_HEADER_TABLE_SIZE immediately.
Instead, buffer any SETTINGS_HEADER_TABLE_SIZE received, and only apply
the new value prior to the next time the server writes a frame.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97032 and Go issue https://go.dev/issue/81867.
This was a PRIVATE track issue originally tracked in http://b/539475988.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81921 (for 1.26), #81922 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847033 mentions this issue:
[release-branch.go1.27] net/http/internal/http2: prevent crash due to HPACK encoder racegopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847111 mentions this issue:
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes[release-branch.go1.27] net/http/internal/http2: prevent crash due to…
[release-branch.go1.26] net/http: bundled HTTP/2 vuln fixes
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847188 mentions this issue:
http2: prevent crash due to HPACK encoder racegopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847313 mentions this issue:
net/http/internal/http2: prevent crash due to HPACK encoder racenet/http/internal/http2: prevent crash due to HPACK encoder race
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847350 mentions this issue:
[internal-branch.go1.26-vendor] http2: prevent crash due to HPACK encoder race[internal-branch.go1.26-vendor] http2: prevent crash due to HPACK enc…
http2: prevent crash due to HPACK encoder race