# net/http (Go) vulnerabilities 18 known vulnerabilities (1 critical, 6 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/net/http ## Advisories (18) ### [CVE-2026-56853](https://cve.now/CVE-2026-56853): Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3. ### [CVE-2026-39821](https://cve.now/CVE-2026-39821): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna - Severity: Critical 9.6 - Published: May 22, 2026 - Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3. ### [CVE-2026-33814](https://cve.now/CVE-2026-33814): Infinite loop in HTTP/2 transport when given bad SETTINGS\_MAX\_FRAME\_SIZE in net/http/internal/http2 in golang.org/x/net - Severity: High 7.5 - Published: May 7, 2026 - Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3. ### [CVE-2025-58186](https://cve.now/CVE-2025-58186): Lack of limit when parsing cookies can cause memory exhaustion in net/http - Severity: Medium 5.3 - Published: Oct 29, 2025 - Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2. ### [CVE-2025-47910](https://cve.now/CVE-2025-47910): CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http - Severity: Medium 5.4 - Published: Sep 22, 2025 - Affected: from 1.25.0, fixed in 1.25.1. ### [CVE-2025-4673](https://cve.now/CVE-2025-4673): Sensitive headers not cleared on cross-origin redirect in net/http - Severity: Medium 6.8 - Published: Jun 11, 2025 - Affected: fixed in 1.23.10; from 1.24.0-0, fixed in 1.24.4. ### [CVE-2025-22870](https://cve.now/CVE-2025-22870): HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net - Severity: Medium 4.4 - Published: Mar 12, 2025 - Affected: fixed in 1.23.7; from 1.24.0-0, fixed in 1.24.1. ### [CVE-2024-45336](https://cve.now/CVE-2024-45336): Sensitive headers incorrectly sent after cross-domain redirect in net/http - Severity: Medium 6.1 - Published: Jan 28, 2025 - Affected: fixed in 1.22.11; from 1.23.0-0, fixed in 1.23.5; from 1.24.0-0, fixed in 1.24.0-rc.2. ### [CVE-2024-24791](https://cve.now/CVE-2024-24791): Denial of service due to improper 100-continue handling in net/http - Severity: High 7.5 - Published: Jul 2, 2024 - Affected: fixed in 1.21.12; from 1.22.0-0, fixed in 1.22.5. ### [CVE-2023-45288](https://cve.now/CVE-2023-45288): HTTP/2 CONTINUATION flood in net/http - Severity: High 7.5 - Published: Apr 4, 2024 - Affected: fixed in 1.21.9; from 1.22.0-0, fixed in 1.22.2; fixed in 1.21.9; from 1.22.0-0, fixed in 1.22.2. ### [CVE-2023-45289](https://cve.now/CVE-2023-45289): Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http - Severity: Medium 4.3 - Published: Mar 5, 2024 - Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1. ### [CVE-2023-39325](https://cve.now/CVE-2023-39325): HTTP/2 rapid reset can cause excessive work in net/http - Severity: Unrated - Published: Oct 11, 2023 - Affected: fixed in 1.20.10; from 1.21.0-0, fixed in 1.21.3. ### [CVE-2023-29406](https://cve.now/CVE-2023-29406): Insufficient sanitization of Host header in net/http - Severity: Unrated - Published: Jul 11, 2023 - Affected: fixed in 1.19.11; from 1.20.0-0, fixed in 1.20.6. ### [CVE-2022-41723](https://cve.now/CVE-2022-41723): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net - Severity: High 7.5 - Published: Feb 28, 2023 - Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1. ### [CVE-2022-41717](https://cve.now/CVE-2022-41717): Excessive memory growth in net/http and golang.org/x/net/http2 - Severity: Unrated - Published: Dec 8, 2022 - Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4. ### [CVE-2022-41720](https://cve.now/CVE-2022-41720): Restricted file access on Windows in os and net/http - Severity: High 7.5 - Published: Dec 7, 2022 - Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4. ### [CVE-2022-32148](https://cve.now/CVE-2022-32148): Exposure of client IP addresses in net/http - Severity: Medium 6.5 - Published: Aug 9, 2022 - Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4. ### [CVE-2022-1705](https://cve.now/CVE-2022-1705): Improper sanitization of Transfer-Encoding headers in net/http - Severity: Medium 6.5 - Published: Aug 9, 2022 - Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/net/http Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.