Skip to content

security: fix CVE-2026-78663 [1.27 backport] #81906

Closed
Closed
security: fix CVE-2026-78663 [1.27 backport]#81906
Labels
CherryPickApprovedUsed during the release process for point releasesSecurity
Milestone
Go1.27.2

Description

@gopherbot
gopherbot
opened on Sep 30, 2026

@thatnealpatel requested issue #81743 to be considered for backport to the next 1.27 minor release.

@gopherbot Please open backports for this security issue.

Activity

  1. gopherbot
    added
    Security
    CherryPickCandidateUsed during the release process for point releases
    on Sep 30, 2026
  2. gopherbot
    added this to the Go1.27.2 milestone on Sep 30, 2026
  3. thatnealpatel
    added
    CherryPickApprovedUsed during the release process for point releases
    and removed
    CherryPickCandidateUsed during the release process for point releases
    on Sep 30, 2026

  4. gopherbot commented on Oct 8, 2026

    @gopherbot
    gopherbot
    on Oct 8, 2026
    ContributorAuthor

    Change https://go.dev/cl/847032 mentions this issue: [release-branch.go1.27] net/http/internal/http2: avoid 2x refund on stream close with buffered data

  5. gopherbot
    added a commit that references this issue on Oct 8, 2026

    [release-branch.go1.27] net/http/internal/http2: avoid 2x refund on s…

    31dc9e2

  6. gopherbot commented on Oct 8, 2026

    @gopherbot
    gopherbot
    on Oct 8, 2026
    ContributorAuthor

    Closed by merging CL 847032 (commit 31dc9e2) to release-branch.go1.27.

  7. gopherbot
    closed this as completedon Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    CherryPickApprovedUsed during the release process for point releasesSecurity

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions