{"id":"CVE-2026-78660","published":"2026-10-08T23:17:03.510","lastModified":"2026-10-09T17:16:49.243","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/835145","tags":[]},{"url":"https://go.dev/cl/836385","tags":[]},{"url":"https://go.dev/issue/81115","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6610","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows HTTP/2 implementations to forward malformed framing headers to HTTP/1 clients when acting as a reverse proxy, potentially enabling response smuggling attacks. The flaw occurs because HTTP/2 handling was too permissive with malformed headers that don't affect HTTP/2 framing but can interfere with HTTP/1 processing.","exploitability":"Exploitation requires a specific chain involving an HTTP/2 reverse proxy forwarding to an HTTP/1 client, with both sides having lax header validation, making it moderately difficult to exploit without specific conditions.","blast_radius":"The impact is limited to environments using HTTP/2 reverse proxies that forward responses to HTTP/1 clients, potentially allowing attackers to smuggle responses and bypass security controls in vulnerable configurations.","remediation":"Upgrade to version 2.590 or later to fix the malformed header handling in HTTP/2 implementation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["http","proxy","web"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:24:05.730Z"}}