Fluid Attacks Database

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	golang-1.26	=1.26.0-1 \|\| =1.26.1-1 \|\| =1.26.2-1 \|\| =1.26.2-2 \|\| =1.26.2-3 \|\| =1.26.3-1 \|\| =1.26.3-1~bpo13+1 \|\| =1.26.3-2 \|\| =1.26.3-2~bpo13+1 \|\| =1.26.4-1 \|\| =1.26.4-1~bpo13+1 \|\| =1.26.5-1 \|\| =1.26.5-1~bpo13+1 \|\| =1.26~rc2-1 \|\| =1.26~rc3-1 \|\| =1.26~rc3-2 \|\| >=0 <1.26.6-1	1.26.6-1
rpm rhel10	image-builder	<0:52.1-1.el10_2.2	0:52.1-1.el10_2.2
rpm rhel10	osbuild-composer	<0:165.1-3.el10_2.2	0:165.1-3.el10_2.2
rpm rhel9	buildah	<2:1.43.3-2.el9_8	2:1.43.3-2.el9_8
rpm rhel10.2	buildah	<2:1.43.1-5.el10_2	2:1.43.1-5.el10_2
rpm rhel10.0	delve	<0:1.26.1-2.el10_0	0:1.26.1-2.el10_0
rpm rhel9.6	delve	<0:1.26.1-1.el9_6.1	0:1.26.1-1.el9_6.1
rpm rhel10.0	golang	<0:1.26.7-1.el10_0	0:1.26.7-1.el10_0
rpm rhel9.6	golang	<0:1.26.7-1.el9_6	0:1.26.7-1.el9_6
rpm rhel10.0	grafana	<0:10.2.6-26.el10_0	0:10.2.6-26.el10_0

1-10 of 70

Aliases

1. CVE-2026-568532. NVD-2026-568533. OSV-DEBIAN-2026-568534. OSV-2026-568535. OSV-GO-2026-60896. GCVE-2026-568537. SECURITY-TRACKER-CVE-2026-56853

References

1. https://go.dev/issue/802052. https://go.dev/cl/7955403. https://groups.google.com/g/golang-announce/c/94pEornpRlI

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.