Loading vulnerability…
Denial of Service in Go net/http Unencrypted HTTP/2 Preface Detection
CVE-2026-56853 is a timeout-enforcement vulnerability in Go's net/http package affecting servers configured to support unencrypted HTTP/2. When examining a new connection for the HTTP/2 client preface, the server reads initial bytes without applying the configured ReadHeaderTimeout. A client can stall this preliminary read and retain connections beyond the expected header timeout, potentially causing resource exhaustion and denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote clients can hold connections open during HTTP/2 preface detection without the expected ReadHeaderTimeout being enforced. Repeated stalled connections can consume server resources and degrade or deny service to legitimate clients. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
No vendor-specified temporary workaround is available. As an exposure-reduction measure, disable unencrypted HTTP/2 support where operationally feasible or restrict network access to the affected listener to trusted clients. Do not rely on ReadHeaderTimeout alone to bound the initial HTTP/2 preface-detection read.
Patch, then assume compromise.
Apply vendor security updates that address CVE-2026-56853 to affected Go-based applications and bundled components. For Red Hat Enterprise Linux 10 deployments with the affected oci-seccomp-bpf-hook package, install the update specified by RHSA-2026:89752. Exact upstream Go affected-version ranges and fixed releases are not available in the supplied vulnerability details.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
265 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.