net/http

Advisories 18

• CVE-2026-56853High 7.5

  Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

  Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

• CVE-2026-39821Critical 9.6

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

• CVE-2026-33814High 7.5

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

• CVE-2025-58186Medium 5.3

  Lack of limit when parsing cookies can cause memory exhaustion in net/http

  Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

• CVE-2025-47910Medium 5.4

  CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

  Affected: from 1.25.0, fixed in 1.25.1.

• CVE-2025-4673Medium 6.8

  Sensitive headers not cleared on cross-origin redirect in net/http

  Affected: fixed in 1.23.10; from 1.24.0-0, fixed in 1.24.4.

• CVE-2025-22870Medium 4.4

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Affected: fixed in 1.23.7; from 1.24.0-0, fixed in 1.24.1.

• CVE-2024-45336Medium 6.1

  Sensitive headers incorrectly sent after cross-domain redirect in net/http

  Affected: fixed in 1.22.11; from 1.23.0-0, fixed in 1.23.5; from 1.24.0-0, fixed in 1.24.0-rc.2.

• CVE-2024-24791High 7.5

  Denial of service due to improper 100-continue handling in net/http

  Affected: fixed in 1.21.12; from 1.22.0-0, fixed in 1.22.5.

• CVE-2023-45288High 7.5

  HTTP/2 CONTINUATION flood in net/http

  Affected: fixed in 1.21.9; from 1.22.0-0, fixed in 1.22.2; fixed in 1.21.9; from 1.22.0-0, fixed in 1.22.2.

• CVE-2023-45289Medium 4.3

  Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

  Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

• CVE-2023-39325Unrated

  HTTP/2 rapid reset can cause excessive work in net/http

  Affected: fixed in 1.20.10; from 1.21.0-0, fixed in 1.21.3.

• CVE-2023-29406Unrated

  Insufficient sanitization of Host header in net/http

  Affected: fixed in 1.19.11; from 1.20.0-0, fixed in 1.20.6.

• CVE-2022-41723High 7.5

  Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

  Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

• CVE-2022-41717Unrated

  Excessive memory growth in net/http and golang.org/x/net/http2

  Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4.