{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97032", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-09-23T23:03:58.333Z", "datePublished": "2026-10-08T22:54:00.230Z", "dateUpdated": "2026-10-08T22:54:00.230Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-10-08T22:54:00.230Z"}, "title": "HTTP/2 server crash due to HPACK encoder race in net/http", "descriptions": [{"lang": "en", "value": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}], "affected": [{"vendor": "Go standard library", "product": "net/http", "collectionURL": "https://pkg.go.dev", "packageName": "net/http", "versions": [{"version": "0", "lessThan": "1.26.9", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "http2serverConn.processSetting"}, {"name": "http2serverConn.startFrameWrite"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "defaultStatus": "unaffected"}, {"vendor": "Go standard library", "product": "net/http/internal/http2", "collectionURL": "https://pkg.go.dev", "packageName": "net/http/internal/http2", "versions": [{"version": "1.27.0-0", "lessThan": "1.27.2", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "serverConn.processSetting"}, {"name": "serverConn.startFrameWrite"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "NetHTTPClientConn.Close"}, {"name": "NetHTTPClientConn.Ping"}, {"name": "NetHTTPClientConn.RoundTrip"}, {"name": "ReadFrameHeader"}, {"name": "Server.GracefulShutdown"}, {"name": "Server.ServeConn"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "Transport.AddConn"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "requestBody.Close"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "serve400Handler.ServeHTTP"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}], "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/net", "product": "golang.org/x/net/http2", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/net/http2", "versions": [{"version": "0", "lessThan": "0.60.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "serverConn.processSetting"}, {"name": "serverConn.startFrameWrite"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "pseudoHeaderError.Error"}, {"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "references": [{"url": "https://go.dev/cl/847188"}, {"url": "https://go.dev/cl/847313"}, {"url": "https://go.dev/issue/81867"}, {"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6617"}], "credits": [{"lang": "en", "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "net/http", "product": "net/http", "programRoutines": [{"name": "http2serverConn.processSetting"}, {"name": "http2serverConn.startFrameWrite"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.26.9", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "net/http/internal/http2", "product": "net/http/internal/http2", "programRoutines": [{"name": "serverConn.processSetting"}, {"name": "serverConn.startFrameWrite"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "NetHTTPClientConn.Close"}, {"name": "NetHTTPClientConn.Ping"}, {"name": "NetHTTPClientConn.RoundTrip"}, {"name": "ReadFrameHeader"}, {"name": "Server.GracefulShutdown"}, {"name": "Server.ServeConn"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "Transport.AddConn"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "requestBody.Close"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "serve400Handler.ServeHTTP"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.27.2", "status": "affected", "version": "1.27.0-0", "versionType": "semver"}]}, {"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/net/http2", "product": "golang.org/x/net/http2", "programRoutines": [{"name": "serverConn.processSetting"}, {"name": "serverConn.startFrameWrite"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "pseudoHeaderError.Error"}, {"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "vendor": "golang.org/x/net", "versions": [{"lessThan": "0.60.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}], "id": "CVE-2026-97032", "lastModified": "2026-10-08T23:17:06.213", "metrics": {}, "published": "2026-10-08T23:17:06.213", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/847188"}, {"source": "security@golang.org", "url": "https://go.dev/cl/847313"}, {"source": "security@golang.org", "url": "https://go.dev/issue/81867"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-6617"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Received"}

{"bugzilla": {"description": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "id": "2548337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548337"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash."], "name": "CVE-2026-97032", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "helm", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Fix deferred", "package_name": "openshift-pipelines-client", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "kn-workflow-plugin", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-clients", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Fix deferred", "package_name": "istio-proxy", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Affected", "impact": "moderate", "package_name": "openshift-golang-builder-container", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-gateway-proxy", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "automation-gateway-proxy-openssl30", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "automation-gateway-proxy-openssl32", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "receptor", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "libarrow", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:certifications:9", "fix_state": "Fix deferred", "package_name": "redhat-certification-cnf", "product_name": "Red Hat Certification Program for Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:certifications:9", "fix_state": "Fix deferred", "package_name": "redhat-certification-preflight", "product_name": "Red Hat Certification Program for Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Fix deferred", "package_name": "flightctl", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "butane", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "conmon", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "delve", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "git-lfs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "go-fdo-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "go-fdo-server", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "golang", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "golang-github-openprinting-ipp-usb", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana-pcp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "gvisor-tap-vsock", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "ignition", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "image-builder", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "oci-delta", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "oci-seccomp-bpf-hook", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "opentelemetry-collector", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "osbuild-composer", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhc-worker-playbook", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "skopeo", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "toolbox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "weldr-client", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "yggdrasil", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "compat-sap-c++-11", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "host-metering", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "rhc-worker-script", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "compat-sap-c++-11", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/conmon", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/containernetworking-plugins", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/crun", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/oci-seccomp-bpf-hook", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/runc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/skopeo", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "container-tools:rhel8/toolbox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "git-lfs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "go-toolset:rhel8/golang", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana-pcp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "osbuild-composer", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "weldr-client", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "butane", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "conmon", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "containernetworking-plugins", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "delve", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "git-lfs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "golang", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana-pcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "gvisor-tap-vsock", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "ignition", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "image-builder", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "oci-delta", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "oci-seccomp-bpf-hook", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "opentelemetry-collector", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "osbuild-composer", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "skopeo", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "toolbox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "weldr-client", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "golang", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "butane", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "conmon", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "conmon-rs", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "containernetworking-plugins", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "cri-o", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "cri-tools", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "golang-github-prometheus-promu", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "ignition", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "kata-containers", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "microshift", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift-clients", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "moderate", "package_name": "openshift-golang-builder-container", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift-kuryr", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "ose-aws-ecr-image-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "ose-azure-acr-image-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "ose-crio-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "ose-gcp-gcr-image-credential-provider", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "skopeo", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "toolbox", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_service_on_aws:1", "fix_state": "Fix deferred", "package_name": "rosa", "product_name": "Red Hat OpenShift on AWS"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "impact": "moderate", "package_name": "openshift-golang-builder-container", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "golang-github-infrawatch-apputils", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "golang-github-Sirupsen-logrus", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "collectd-libpod-stats", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "golang-github-infrawatch-apputils", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "golang-github-Sirupsen-logrus", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "golang-uber-atomic", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "golang-uber-multierr", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "etcd", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "golang-github-openstack-k8s-operators-os-diff", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "yggdrasil-worker-forwarder", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:service_interconnect:1", "fix_state": "Out of support scope", "package_name": "skupper-cli", "product_name": "Red Hat Service Interconnect 1"}, {"cpe": "cpe:/a:redhat:service_interconnect:2", "fix_state": "Fix deferred", "package_name": "skupper-cli", "product_name": "Red Hat Service Interconnect 2"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Out of support scope", "package_name": "golang-github-danielqsj-kafka_exporter", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "golang-github-danielqsj-kafka_exporter", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-10-08T22:54:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97032\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97032\nhttps://go.dev/cl/847188\nhttps://go.dev/cl/847313\nhttps://go.dev/issue/81867\nhttps://groups.google.com/g/golang-announce/c/U2fTuyDJznI\nhttps://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs\nhttps://pkg.go.dev/vuln/GO-2026-6617"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.26.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "net/http", "source": "cna", "vendor": "Go standard library"}, "product": "net/http", "vendor": "go_standard_library"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.27.0-0,1.27.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "net/http/internal/http2", "source": "cna", "vendor": "Go standard library"}, "product": "net/http", "vendor": "go_standard_library"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.60.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/net/http2", "source": "cna", "vendor": "golang.org/x/net"}, "product": "net/http2", "vendor": "go_standard_library"}], "created": "2026-10-09T00:30:17.782463+00:00", "updated": "2026-10-09T08:02:01.911888+00:00", "vendors": ["go_standard_library", "go_standard_library$PRODUCT$net/http", "go_standard_library$PRODUCT$net/http2"]}