Bug 2548344 (CVE-2026-78669)
| Summary: | CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abarbaro, akhatavk, akostadi, alizardo, amasferr, amctagga, ansmith, anthomas, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, chfoley, cmah, crizzo, dakwon, dhanak, dkeler, dmayorov, dpaolell, drosa, dschmidt, dsimansk, eaguilar, ebaron, eborisov, eglynn, ehelms, flucifre, ggainey, gmeno, groman, jbritton, jburrell, jchui, jdelft, jhe, jjoyce, jlanda, jlledo, jmatsuok, jpasqual, jpretori, jschluet, jtolenti, jturenov, jupierce, juwatts, kaycoth, kingland, kshier, ktsao, lball, lblicha, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, nboldt, ngough, nmoumoul, oaljalju, ogajduse, osousa, pantinor, pcreech, pjindal, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rchan, rhel-process-autobot, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, smallamp, sostapov, stcannon, suppawar, swoodman, thason, tmalecek, tsedmik, vereddy, veshanka, vkarehfa, vlaad, watson-tool-maintainers, yguenane, zhunting |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-08 23:01:52 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:86093 https://access.redhat.com/errata/RHSA-2026:86093 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:86203 https://access.redhat.com/errata/RHSA-2026:86203 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:86196 https://access.redhat.com/errata/RHSA-2026:86196 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:88188 https://access.redhat.com/errata/RHSA-2026:88188 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:88189 https://access.redhat.com/errata/RHSA-2026:88189 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:88262 https://access.redhat.com/errata/RHSA-2026:88262 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:88280 https://access.redhat.com/errata/RHSA-2026:88280 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:88316 https://access.redhat.com/errata/RHSA-2026:88316 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:88336 https://access.redhat.com/errata/RHSA-2026:88336 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:88354 https://access.redhat.com/errata/RHSA-2026:88354 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:89741 https://access.redhat.com/errata/RHSA-2026:89741 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:89744 https://access.redhat.com/errata/RHSA-2026:89744 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:89740 https://access.redhat.com/errata/RHSA-2026:89740 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:89751 https://access.redhat.com/errata/RHSA-2026:89751 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:89832 https://access.redhat.com/errata/RHSA-2026:89832 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:89884 https://access.redhat.com/errata/RHSA-2026:89884 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:89888 https://access.redhat.com/errata/RHSA-2026:89888 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:89885 https://access.redhat.com/errata/RHSA-2026:89885 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:89892 https://access.redhat.com/errata/RHSA-2026:89892 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:89908 https://access.redhat.com/errata/RHSA-2026:89908 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:89915 https://access.redhat.com/errata/RHSA-2026:89915 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:89914 https://access.redhat.com/errata/RHSA-2026:89914 This issue has been addressed in the following products: Red Hat OpenStack Platform 17.1 for RHEL 9 Via RHSA-2026:90329 https://access.redhat.com/errata/RHSA-2026:90329 This issue has been addressed in the following products: Red Hat OpenStack Services on OpenShift 18.0 Via RHSA-2026:90332 https://access.redhat.com/errata/RHSA-2026:90332 This issue has been addressed in the following products: Red Hat OpenStack Platform 16.2 Via RHSA-2026:90330 https://access.redhat.com/errata/RHSA-2026:90330 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:89933 https://access.redhat.com/errata/RHSA-2026:89933 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:90725 https://access.redhat.com/errata/RHSA-2026:90725 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:90726 https://access.redhat.com/errata/RHSA-2026:90726 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:90994 https://access.redhat.com/errata/RHSA-2026:90994 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:91138 https://access.redhat.com/errata/RHSA-2026:91138 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:91572 https://access.redhat.com/errata/RHSA-2026:91572 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:91587 https://access.redhat.com/errata/RHSA-2026:91587 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:91646 https://access.redhat.com/errata/RHSA-2026:91646 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:91958 https://access.redhat.com/errata/RHSA-2026:91958 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:92217 https://access.redhat.com/errata/RHSA-2026:92217 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:92372 https://access.redhat.com/errata/RHSA-2026:92372 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.7 for RHEL 10 Red Hat Ansible Automation Platform 2.7 for RHEL 9 Via RHSA-2026:92622 https://access.redhat.com/errata/RHSA-2026:92622 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:92621 https://access.redhat.com/errata/RHSA-2026:92621 This issue has been addressed in the following products: Red Hat Satellite 6.18 for RHEL 9 Via RHSA-2026:92860 https://access.redhat.com/errata/RHSA-2026:92860 This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:92858 https://access.redhat.com/errata/RHSA-2026:92858 This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:92859 https://access.redhat.com/errata/RHSA-2026:92859 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:93596 https://access.redhat.com/errata/RHSA-2026:93596 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:93617 https://access.redhat.com/errata/RHSA-2026:93617 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:95016 https://access.redhat.com/errata/RHSA-2026:95016 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:95015 https://access.redhat.com/errata/RHSA-2026:95015 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:95014 https://access.redhat.com/errata/RHSA-2026:95014 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:95234 https://access.redhat.com/errata/RHSA-2026:95234 This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2026:95360 https://access.redhat.com/errata/RHSA-2026:95360 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:95519 https://access.redhat.com/errata/RHSA-2026:95519 |