CVE-2026-56853High· 7.5▾ Twilight

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTi…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 13, 2026

Updated

Sep 21, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat OpenShift Container Platform 4.22

CWE

CWE-770

Depth score

41 · Moderate

EPSS

0.57% · p46

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 14.

0.2% → 0.6%▲ 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

16 events · 39 days

Aug 13, 2026Published
Disclosed via CSAF
Aug 14, 2026EPSS first tracked
0.2%
Aug 15, 2026EPSS peak
0.2% → 0.6%
Sep 14, 2026CVSS changed
7.5 → —
Sep 14, 2026Severity changed
high → none
Sep 14, 2026CVSS changed
— → 7.5
Sep 14, 2026Severity changed
none → high
Sep 14, 2026CVSS changed
7.5 → —
Sep 14, 2026Severity changed
high → none
Sep 14, 2026CVSS changed
— → 7.5
Sep 14, 2026Severity changed
none → high
Sep 14, 2026CVSS changed
7.5 → —
Sep 14, 2026Severity changed
high → none
Sep 14, 2026CVSS changed
— → 7.5
Sep 14, 2026Severity changed
none → high
Sep 21, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-770 #csaf #vex #red-hat #osv #go

Affected

Patched in

rhem_1_1_for_rhel 10
rhem_1_2_for_rhel 10
rhem_1_1_for_rhel 9
rhem_1_2_for_rhel 9
enterprise_linux_appstream_eus_v_10_0
enterprise_linux_appstream_v_10
enterprise_linux_appstream_v_8
enterprise_linux_appstream_aus_v_8_6
enterprise_linux_appstream_eus_extension_v_8_6
enterprise_linux_appstream_e4s_v_8_8
enterprise_linux_appstream_tus_v_8_8
enterprise_linux_appstream_e4s_v_9_2
enterprise_linux_appstream_e4s_v_9_4
enterprise_linux_appstream_eus_v_9_6
enterprise_linux_appstream_v_9
custom_metric_autoscaler 2.19
logging_subsystem_for_red_hat_openshift 6.2
logging_subsystem_for_red_hat_openshift 6.6
multicluster_global_hub 1.4.9
multicluster_global_hub 1.7.3
multicluster_global_hub 1.8.2
openshift_api_for_data_protection 1.5
openshift_compliance_operator 1
advanced_cluster_security_for_kubernetes 4.10
advanced_cluster_security_for_kubernetes 4.11
developer_hub 1.9
edge_manager 1.1
edge_manager 1.2
hardened_images
migration_toolkit 1.8
multiarch_tuning 1.3.4
openshift_ai 2.25
openshift_container_platform 4.22
openshift_service_mesh 3.0
openshift_service_mesh 3.1
openshift_service_mesh 3.2
openshift_service_mesh 3.3
openshift_service_mesh 3.4
openshift_distributed_tracing 3.11.1
quay 3.10

Full technical detail▾

Overview

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

Vendor advisories

RHSA-2026:68334 · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:68335 · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:65918 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · advisory
RHSA-2026:61882 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · advisory
RHSA-2026:67517 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · advisory
RHSA-2026:66459 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · advisory
RHSA-2026:65335 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · advisory
RHSA-2026:67974 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · advisory
RHSA-2026:66327 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · advisory
RHSA-2026:63332 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · advisory
RHSA-2026:64777 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · advisory
Red Hat VEX · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Deployment Validation Operator, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, … · updated 2026-09-21 · vex
RHSA-2026:62578 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · advisory
RHSA-2026:60306 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · advisory
RHSA-2026:63022 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · advisory
RHSA-2026:63119 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · advisory
RHSA-2026:65534 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · advisory
RHSA-2026:62631 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · advisory
RHSA-2026:65116 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · advisory

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service — rated Important by Red Hat. Released 2026-08-13, updated 2026-09-21.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
AWS Load Balancer Operator
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Deployment Validation Operator
Exploit Intelligence
ExternalDNS Operator
Fence Agents Remediation Operator
File Integrity Operator
Logical Volume Manager Storage
Machine Deletion Remediation Operator
Migration Toolkit for Applications 8
Multicluster Engine for Kubernetes
Network Observability Operator
Node HealthCheck Operator
Node Maintenance Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Source-to-Image (S2I)
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat Lightspeed for Runtimes Operator
Red Hat OpenShift AI (RHOAI)

Fixed:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Red Hat Enterprise Linux AppStream EUS (v. 10.0)
Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream AUS (v.8.6)
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
Red Hat Enterprise Linux AppStream E4S (v.8.8)
Red Hat Enterprise Linux AppStream TUS (v.8.8)
Red Hat Enterprise Linux AppStream E4S (v.9.2)
Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Red Hat Enterprise Linux AppStream (v. 9)
Custom Metric Autoscaler 2.19
Logging Subsystem for Red Hat OpenShift 6.2
Logging Subsystem for Red Hat OpenShift 6.6
Multicluster Global Hub 1.4.9
Multicluster Global Hub 1.7.3
Multicluster Global Hub 1.8.2
OpenShift API for Data Protection 1.5
OpenShift Compliance Operator 1
Red Hat Advanced Cluster Security for Kubernetes 4.10
Red Hat Advanced Cluster Security for Kubernetes 4.11
Red Hat Developer Hub 1.9
Red Hat Edge Manager 1.1
Red Hat Edge Manager 1.2
Red Hat Hardened Images
Red Hat Migration Toolkit 1.8
Red Hat Multiarch Tuning 1.3.4
Red Hat OpenShift AI 2.25
Red Hat OpenShift Container Platform 4.22
Red Hat OpenShift Service Mesh 3.0
Red Hat OpenShift Service Mesh 3.1
Red Hat OpenShift Service Mesh 3.2
Red Hat OpenShift Service Mesh 3.3
Red Hat OpenShift Service Mesh 3.4
Red Hat OpenShift distributed tracing 3.11.1
Red Hat Quay 3.10

No fix planned:

Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Secrets Management Console for Red Hat OpenShift
Zero Trust Workload Identity Manager - Tech Preview
Assisted Installer for Red Hat OpenShift Container Platform 2
AWS Load Balancer Operator
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Deployment Validation Operator
Exploit Intelligence
ExternalDNS Operator
Fence Agents Remediation Operator
File Integrity Operator
Logical Volume Manager Storage
Machine Deletion Remediation Operator
Migration Toolkit for Applications 8
Multicluster Engine for Kubernetes
Network Observability Operator
Node HealthCheck Operator
Node Maintenance Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Source-to-Image (S2I)
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux AI (RHEL AI) 3

Not affected:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Red Hat Enterprise Linux AppStream (v. 10)
Logging Subsystem for Red Hat OpenShift 6.2
Logging Subsystem for Red Hat OpenShift 6.6
Multicluster Global Hub 1.4.9
Multicluster Global Hub 1.7.3
Multicluster Global Hub 1.8.2

Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68335 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:65918

Package advisory (CVE-2026-56853)

Affected packages:

stdlib >= 1.27.0-0, < 1.27.0-rc.3

Patched in:

stdlib 1.27.0-rc.3

Source: https://osv.dev/vulnerability/GO-2026-6089

References

Change history

Field changes observed since this record was first indexed.

Sep 14, 2026CVSS — → 7.5
Sep 14, 2026Severity none → high
Sep 14, 2026CVSS 7.5 → —
Sep 14, 2026Severity high → none
Sep 14, 2026CVSS — → 7.5
Sep 14, 2026Severity none → high
Sep 14, 2026CVSS 7.5 → —
Sep 14, 2026Severity high → none
Sep 14, 2026CVSS — → 7.5
Sep 14, 2026Severity none → high
Sep 14, 2026CVSS 7.5 → —
Sep 14, 2026Severity high → none

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed