CVE-2026-56853

7.5 highEPSS 0.6%

High (7.5). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in stdlib 1.25.13, 1.26.6, 1.27.0-rc.3.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2026-08-13
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2026-6089	Go	stdlib	<1.25.13 >=1.26.0-0 <1.26.6 >=1.27.0-0 <1.27.0-rc.3	1.25.13, 1.26.6, 1.27.0-rc.3

References

https://go.dev/cl/795540
https://go.dev/issue/80205
https://groups.google.com/g/golang-announce/c/94pEornpRlI
https://pkg.go.dev/vuln/GO-2026-6089

Check your stack JSON