{"id":"CVE-2026-78669","published":"2026-10-08T23:17:04.010","lastModified":"2026-10-09T17:16:49.857","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-405"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847186","tags":[]},{"url":"https://go.dev/cl/847308","tags":[]},{"url":"https://go.dev/issue/81742","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6611","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A malicious HTTP/2 peer can exhaust CPU resources by creating numerous streams and sending frequent SETTINGS frames with small window sizes, leading to excessive processing overhead. This vulnerability allows attackers to cause significant performance degradation without requiring authentication or user interaction.","exploitability":"Exploitation is relatively straightforward requiring only an HTTP/2 connection with a malicious peer that opens many streams and sends frequent SETTINGS frames, with no additional preconditions needed.","blast_radius":"The impact could affect any HTTP/2 server or client under attack, potentially causing denial of service through excessive CPU consumption and degraded performance for legitimate users.","remediation":"Upgrade to nghttp2 version 1.59.0 or later to address this CPU exhaustion vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["http2","dos","cpu"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:53.684Z"}}