{"id":"CVE-2026-78659","published":"2026-10-08T23:17:03.270","lastModified":"2026-10-09T16:35:35.900","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-405"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847185","tags":[]},{"url":"https://go.dev/cl/847314","tags":[]},{"url":"https://go.dev/issue/81857","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6603","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An HTTP/2 server vulnerability where malicious clients can send Trailer headers with excessive field counts, causing disproportionate memory allocation while bypassing existing header limits. This allows attackers to consume server resources without triggering typical header size alarms.","exploitability":"Exploitation requires a malicious client connecting over HTTP/2 with a Trailer header containing many fields, making it moderately difficult but possible for attackers who can control HTTP/2 connections.","blast_radius":"The vulnerability could lead to significant server resource exhaustion across multiple concurrent HTTP/2 connections, potentially causing denial of service for legitimate users.","remediation":"Upgrade to Go 1.23.5 or later, which includes the fix for this memory allocation issue in HTTP/2 trailer handling.","detection":"Monitor HTTP/2 connection logs for unusually high numbers of trailer fields in requests, particularly when processing Trailer headers with more than 100 fields per request.","tags":["http2","memory","dos"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:24:11.444Z"}}