golang.org/x/net golang.org/x/net/http2
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97032 | < 0.60.0 | HTTP/2 server crash due to HPACK encoder race in net/http | HIGH 7.5 | 0.5 % | ||
| CVE-2026-78669 | < 0.60.0 | Excessive CPU consumption from repeated initial window changes in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-78663 | < 0.60.0 | Double flow control refund on HTTP/2 server streams in net/http | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-78660 | < 0.60.0 | HTTP/2 transport accepts malformed framing-related headers in net/http | HIGH 7.5 | 0.4 % | ||
| CVE-2026-78659 | < 0.60.0 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | HIGH 7.5 | 0.6 % | ||
| CVE-2026-33814 | < 0.53.0 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net | HIGH 7.5 | 0.8 % | ||
| CVE-2026-27141 | 0.50.0 – < 0.51.0 | Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net | HIGH 7.5 | 0.6 % | ||
| CVE-2023-45288 | < 0.23.0 | HTTP/2 CONTINUATION flood in net/http | HIGH 7.5 | 92 % | ||
| CVE-2023-39325 | < 0.17.0 | HTTP/2 rapid reset can cause excessive work in net/http | HIGH 7.5 | 3.8 % | ||
| CVE-2022-41723 | < 0.7.0 | Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net | HIGH 7.5 | 4.6 % | ||
| CVE-2022-41717 | < 0.4.0 | Excessive memory growth in net/http and golang.org/x/net/http2 | MEDIUM 5.3 | 6.1 % |