Vulnerability in Golang.org/x/net Golang.org/x/net/http2

CVE-2026-78660

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Vulnerability class: HTTP Request Smuggling

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-78660?
CVE-2026-78660 is a high-severity vulnerability in Golang.org/x/net Golang.org/x/net/http2, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.5/10. Published 2026-10-08.
How severe is CVE-2026-78660?
High severity. CVSS v3 base score is 7.5 out of 10.