Go net/http Timeout Bypass Enables Denial of Service on Unencrypted HTTP/2 Servers
Vulnerability Disclosure · 4 sources · Updated 12d ago · First seen Oct 15, 2026
A denial-of-service vulnerability in Go’s net/http package, tracked as CVE-2026-56853 and GO-2026-6089, affects servers configured to support unencrypted HTTP/2. When detecting the HTTP/2 client preface on a new connection, the server fails to apply its ReadHeaderTimeout setting, allowing unauthenticated remote attackers to hold connections open indefinitely and exhaust server resources. Red Hat rates the flaw Important, with a CVSS v3.1 score of 7.5; exploitation requires no user interaction. Vsevolod Naumov and Ainar Garipov of AdGuard reported the issue.
The fix applies ReadHeaderTimeout to the initial protocol-detection read. Affected versions include Go releases before 1.25.13, the 1.26 line before 1.26.6, and 1.27 prereleases before 1.27.0-rc.3. Organizations should identify services with unencrypted HTTP/2 enabled, upgrade to a fixed Go release, and rebuild and redeploy affected applications. Red Hat also lists affected Apache Kafka exporter packages and components marked “Will not fix”; flightctl fixes for RHEM 1.1 and 1.2 were released on September 16, 2026, making product-specific remediation checks necessary.
