Bug 2548345 (CVE-2026-78663)

Summary: CVE-2026-78663 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, amctagga, ansmith, anthomas, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, chfoley, crizzo, dhanak, dkeler, dpaolell, drosa, dschmidt, dsimansk, eglynn, ehelms, flucifre, ggainey, gmeno, groman, ikhan, jbritton, jburrell, jdelft, jeder, jjoyce, jlanda, jpasqual, jpretori, jschluet, jturenov, jupierce, juwatts, kingland, kshier, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, nmoumoul, osousa, pcreech, pjindal, ppalepu, ppostler, prdhamdh, rbobbitt, rchan, rhel-process-autobot, sausingh, sfeifer, sghai, sidsharm, simaishi, smallamp, sostapov, stcannon, suppawar, swoodman, thason, tmalecek, vereddy, vkarehfa, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service (DoS). This issue occurs because the server improperly refunds flow control credits twice for the same data: once when a client resets a stream, and again when the application reads the buffered data. Consequently, a malicious client can exceed configured connection buffer limits.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-08 23:01:56 UTC 
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.