{"id":"CVE-2026-78663","published":"2026-10-08T23:17:03.647","lastModified":"2026-10-09T17:16:49.420","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-675"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847187","tags":[]},{"url":"https://go.dev/cl/847310","tags":[]},{"url":"https://go.dev/issue/81743","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6612","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A HTTP/2 server incorrectly refunds connection-level flow control twice for the same data, allowing a malicious client to bypass configured connection-level flow control limits. This creates a potential for resource exhaustion and denial of service.","exploitability":"Exploitation requires a malicious client capable of managing HTTP/2 streams and resetting them, with no other preconditions needed beyond standard HTTP/2 support.","blast_radius":"If exploited, this flaw could allow an attacker to overwhelm server resources through excessive buffering, potentially leading to service disruption or denial of service across affected connections.","remediation":"Upgrade to version 2.590 or later to fix the double refund issue in HTTP/2 flow control implementation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["http2","flow-control","denial-of-service"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:48:50.503Z"}}