Loading story…
Go fixed CVE-2022-27664, a denial-of-service vulnerability in the HTTP/2 server implementation used by net/http. A remote client could cause a server connection to hang indefinitely when a fatal error interrupted clean shutdown after the server had sent a GOAWAY frame, potentially exhausting server resources through repeated connections.
The fix updated the bundled golang.org/x/net/http2 code and was backported to supported Go 1.18 and 1.19 release branches, including the Go 1.18.6 and 1.19.1 security releases. Go 1.17 did not receive a backport under the project’s release policy; organizations operating affected or unsupported Go versions should upgrade to a supported patched release and assess internet-facing HTTP/2 services for exposure.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Go updated its bundled golang.org/x/net/http2 implementation and created fixes for the Go 1.18 and 1.19 release branches. The issue was closed as completed in commit 29af494.
Go opened an issue for CVE-2022-27664, in which an HTTP/2 server connection could hang indefinitely during shutdown after sending GOAWAY and encountering a fatal error, enabling denial of service.
The golang/go issue tracking CVE-2022-27664 was locked and restricted to collaborators.
A Go project member stated that no backport for Go 1.17 would be provided under the project's release policy.
The Go project released Go 1.19.1 and Go 1.18.6 as security releases.
The Go project released Go 1.18.4 and Go 1.17.12 as security releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
go.dev
Open sourcegroups.google.com
Open sourcegroups.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Maintainers disclosed two high-severity HTTP/2 denial-of-service flaws that can be triggered by malicious protocol frames in widely used implementations. In **nghttp2**, `CVE-2026-27135` causes an assertion failure after session termination has begun if the library continues processing incoming data and encounters a malformed frame that leads to `FRAME_SIZE_ERROR`. The vulnerable paths include `ALTSVC`, `PRIORITY_UPDATE`, and user-defined extension frames, with the issue fixed in **nghttp2 v1.68.1** by adding missing internal state validation; no workaround was provided. In Go's HTTP/2 transport, `CVE-2026-33814` allows a malicious server to force an infinite loop of `CONTINUATION` frame writes by sending a `SETTINGS` frame with `SETTINGS_MAX_FRAME_SIZE=0`, creating a remote denial-of-service condition against HTTP/2 clients. The flaw, tracked as Go issue `#78476` and later documented by Microsoft with a **CVSS 7.5** rating, was fixed by validating received `SETTINGS_MAX_FRAME_SIZE` values before use, underscoring continued risk from improper state and bounds checking in HTTP/2 frame handling.
Aug 25, 2026
A newly disclosed denial-of-service flaw in multiple HTTP/2 server implementations allows remote, unauthenticated attackers to exhaust memory and crash services by abusing normal flow-control behavior. By stalling outbound data transmission—such as by manipulating `SETTINGS_INITIAL_WINDOW_SIZE` or withholding `WINDOW_UPDATE` frames—an attacker can cause vulnerable servers to keep generating and buffering full responses, leading to out-of-memory conditions, swap thrashing, worker-thread exhaustion, service freezes, or kernel OOM kills. CERT/CC is tracking the issue after it was reported by the Okta Red Team, and the coordinated disclosures include `CVE-2026-44909`, `CVE-2026-59173`, and `CVE-2026-59762`. Affected vendors named in advisories include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Apache Traffic Server users were advised to upgrade to versions `9.1.14` or `10.1.3`, while F5 published guidance for BIG-IP and other vendors issued product-specific fixes or mitigations. Recommended defenses include stricter memory limits, limiting concurrent HTTP/2 streams, terminating stalled connections, and improving timeout and backpressure handling. No public exploitation has been confirmed, but the low complexity of the attack has prompted calls for rapid patching and configuration hardening.
Jul 24, 2026
CERT/CC disclosed **VU#885548**, a denial-of-service condition in some HTTP/2 server implementations that can be triggered remotely without authentication by abusing stalled flow-control behavior. An attacker can advertise settings such as `SETTINGS_INITIAL_WINDOW_SIZE = 0` or stop sending `WINDOW_UPDATE` frames, forcing servers to buffer large response bodies in memory across many concurrent streams. The resulting impact can include memory exhaustion, swap thrashing, worker or connection exhaustion, service instability, and in severe cases a full crash. Okta Red Team was credited with reporting the issue, and the advisory linked the problem to **`CVE-2026-59762`**, **`CVE-2026-59173`**, and **`CVE-2026-44909`**. F5 said **`CVE-2026-59762`** affects **BIG-IP** and related **BIG-IP Next** products when an HTTP/2 profile is configured on a virtual server, allowing crafted requests to drive up memory use in the **TMM** process until performance degrades or TMM restarts; the company rated the flaw **CVSS 7.5** under v3.1 and **8.7** under v4.0 and urged customers to install patched releases. Apache also confirmed **`CVE-2026-59173`** in **Apache Traffic Server** versions **9.0.0 through 9.2.13** and **10.0.0 through 10.1.2**, recommending upgrades to **9.2.14+** or **10.1.3+**. CERT noted that several vendors have already issued fixes, while some products including GNU wget, Go, HAProxy, ISC BIND, lighttpd, and nghttp2 were listed as not affected.
Jul 17, 2026