HIGH7.5

GO-2026-6611

Excessive CPU consumption from repeated initial window changes in net/http

Quick fix

GO-2026-6611 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.26.9

Details

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.26.9

Fixgo get stdlib@v1.26.9

Go/stdlib

Introduced in: 1.27.0-0Fixed in: 1.27.2

Fixgo get stdlib@v1.27.2

Go/golang.org/x/net

Introduced in: 0Fixed in: 0.60.0

Fixgo get golang.org/x/net@v0.60.0

References

https://go.dev/cl/847186[FIX]
https://go.dev/cl/847308[FIX]
https://go.dev/issue/81742[REPORT]
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI[WEB]
https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs[WEB]