Bug 2548344 (CVE-2026-78669) - CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
Summary: CVE-2026-78669 net/http: net/http/internal/http2: golang.org/x/net/http2: net...
Keywords:
Status: NEW
Alias: CVE-2026-78669
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 23:01 UTC by OSIDB Bzimport
Modified: 2026-10-13 15:19 UTC (History)
90 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 23:01:52 UTC 
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Note You need to log in before you can comment on or make changes to this bug.