p PatchFirst

CVE-2026-97032

CVE-2026-97032 · HTTP/2 server crash due to HPACK encoder race in net/http

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • net/http

    Versions
    • ≥ 0, < 1.26.9: Affected (semver)

    Update to 1.26.9

  • net/http/internal/http2

    Versions
    • ≥ 1.27.0-0, < 1.27.2: Affected (semver)

    Update to 1.27.2

  • golang.org/x/net/http2

    Versions
    • ≥ 0, < 0.60.0: Affected (semver)

    Update to 0.60.0

  • golang-1.19 Debian:12

    Versions
    • 1.19.10-1
    • 1.19.10-2
    • 1.19.11-1
    • 1.19.12-1
    • 1.19.12-2
    • 1.19.12-2~bpo11+1
    • 1.19.12-2~bpo12+1
    • 1.19.13-1
    • 1.19.13-1~bpo11+1
    • 1.19.13-1~bpo12+1
    • 1.19.8-2
    • 1.19.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Debian:13

    Versions
    • 1.24.12-1
    • 1.24.13-1
    • 1.24.13-2
    • 1.24.4-1
    • 1.24.4-2
    • 1.24.4-3
    • 1.24.4-4
    • 1.24.7-1
    • 1.24.8-1
    • 1.24.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Debian:14

    Versions
    • 1.26.0-1
    • 1.26.1-1
    • 1.26.2-1
    • 1.26.2-2
    • 1.26.2-3
    • 1.26.3-1
    • 1.26.3-1~bpo13+1
    • 1.26.3-2
    • 1.26.3-2~bpo13+1
    • 1.26.4-1
    • 1.26.4-1~bpo13+1
    • 1.26.5-1
    • 1.26.5-1~bpo13+1
    • 1.26.6-1
    • 1.26.6-2
    • 1.26.7-1
    • 1.26.7-1~bpo13+1
    • 1.26.8-1
    • 1.26.8-1~bpo13+1
    • 1.26.8-2
    • 1.26~rc2-1
    • 1.26~rc3-1
    • 1.26~rc3-2
    Affected ranges
    • ECOSYSTEM: < 1.26.9-1

    Update to 1.26.9-1

  • golang-1.27 Debian:14

    Versions
    • 1.27.0-1
    • 1.27.0-1~bpo13+1
    • 1.27.1-1
    • 1.27.1-2
    • 1.27.1-2~bpo13+1
    • 1.27.2-1~bpo13+1
    • 1.27~rc1-1
    • 1.27~rc2-1
    • 1.27~rc3-1
    Affected ranges
    • ECOSYSTEM: < 1.27.2-1

    Update to 1.27.2-1

  • golang-golang-x-net Debian:12

    Versions
    • 1:0.10.0-1
    • 1:0.11.0-1
    • 1:0.14.0-1
    • 1:0.15.0-1
    • 1:0.15.0-2
    • 1:0.17.0+dfsg-1
    • 1:0.19.0+dfsg-1
    • 1:0.20.0+dfsg-1
    • 1:0.21.0+dfsg-1
    • 1:0.22.0+dfsg-1
    • 1:0.23.0+dfsg-1
    • 1:0.24.0+dfsg-1
    • 1:0.25.0+dfsg-1
    • 1:0.26.0+dfsg-1
    • 1:0.26.0+dfsg-2
    • 1:0.27.0-1
    • 1:0.27.0-2
    • 1:0.47.0-1
    • 1:0.47.0-2
    • 1:0.53.0-1
    • 1:0.53.0-2
    • 1:0.53.0-2~bpo13+1
    • 1:0.55.0-1
    • 1:0.56.0-1
    • 1:0.57.0-1
    • 1:0.58.0-1
    • 1:0.60.0-1
    • 1:0.7.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-net Debian:13

    Versions
    • 1:0.27.0-2
    • 1:0.47.0-1
    • 1:0.47.0-2
    • 1:0.53.0-1
    • 1:0.53.0-2
    • 1:0.53.0-2~bpo13+1
    • 1:0.55.0-1
    • 1:0.56.0-1
    • 1:0.57.0-1
    • 1:0.58.0-1
    • 1:0.60.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-net Debian:14

    Versions
    • 1:0.27.0-2
    • 1:0.47.0-1
    • 1:0.47.0-2
    • 1:0.53.0-1
    • 1:0.53.0-2
    • 1:0.53.0-2~bpo13+1
    • 1:0.55.0-1
    • 1:0.56.0-1
    • 1:0.57.0-1
    • 1:0.58.0-1
    Affected ranges
    • ECOSYSTEM: < 1:0.60.0-1

    Update to 1:0.60.0-1

  • golang-1.10 Ubuntu:14.04:LTS

    Versions
    • 1.10.4-2ubuntu1~14.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:16.04:LTS

    Versions
    • 1.10.4-2ubuntu1~16.04.1
    • 1.10.4-2ubuntu1~16.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.6 Ubuntu:16.04:LTS

    Versions
    • 1.6-0ubuntu1
    • 1.6-0ubuntu2
    • 1.6-0ubuntu3
    • 1.6-0ubuntu4
    • 1.6-0ubuntu5
    • 1.6.1-0ubuntu1
    • 1.6.2-0ubuntu5~16.04
    • 1.6.2-0ubuntu5~16.04.2
    • 1.6.2-0ubuntu5~16.04.3
    • 1.6.2-0ubuntu5~16.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-net-dev Ubuntu:Pro:16.04:LTS

    Versions
    • 0.0+git20150226.3d87fd6-3
    • 0.0+git20151007.b846920+dfsg-1
    • 1:0.0+git20150817.66f0418-1
    • 1:0.0+git20160110.4fd4a9f-1
    • 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
    • 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • juju-core Ubuntu:Pro:16.04:LTS

    Versions
    • 1.24.6-0ubuntu3
    • 1.25.0-0ubuntu1
    • 1.25.0-0ubuntu2
    • 1.25.0-0ubuntu3
    • 2.0~beta4-0ubuntu2
    • 2.0~beta6-0ubuntu1.16.04.1
    • 2.0~beta7-0ubuntu1.16.04.1
    • 2.0~beta12-0ubuntu1.16.04.1
    • 2.0~beta15-0ubuntu2.16.04.1
    • 2.0.0-0ubuntu0.16.04.2
    • 2.0.2-0ubuntu0.16.04.1
    • 2.0.2-0ubuntu0.16.04.2
    • 2.3.1-0ubuntu0.16.04.1
    • 2.3.2-0ubuntu0.16.04.1
    • 2.3.7-0ubuntu0.16.04.1
    • 2.3.7-0ubuntu0.16.04.1+esm1
    • 2.3.7-0ubuntu0.16.04.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lxd Ubuntu:Pro:16.04:LTS

    Versions
    • 0.20-0ubuntu4
    • 0.21-0ubuntu3
    • 0.21-0ubuntu5
    • 0.22-0ubuntu1
    • 0.22-0ubuntu2
    • 0.23-0ubuntu1
    • 0.23-0ubuntu2
    • 0.23-0ubuntu3
    • 0.24-0ubuntu2
    • 0.24-0ubuntu3
    • 0.24-0ubuntu4
    • 0.25-0ubuntu1
    • 0.26-0ubuntu2
    • 0.26-0ubuntu3
    • 0.27-0ubuntu1
    • 0.27-0ubuntu2
    • 2.0.0~beta1-0ubuntu3
    • 2.0.0~beta1-0ubuntu4
    • 2.0.0~beta2-0ubuntu1
    • 2.0.0~beta2-0ubuntu2
    • 2.0.0~beta3-0ubuntu1
    • 2.0.0~beta3-0ubuntu2
    • 2.0.0~beta3-0ubuntu3
    • 2.0.0~beta3-0ubuntu4
    • 2.0.0~beta4-0ubuntu1
    • 2.0.0~beta4-0ubuntu2
    • 2.0.0~beta4-0ubuntu3
    • 2.0.0~beta4-0ubuntu4
    • 2.0.0~beta4-0ubuntu5
    • 2.0.0~beta4-0ubuntu6
    • 2.0.0~beta4-0ubuntu7
    • 2.0.0~rc1-0ubuntu1
    • 2.0.0~rc1-0ubuntu2
    • 2.0.0~rc1-0ubuntu3
    • 2.0.0~rc2-0ubuntu2
    • 2.0.0~rc2-0ubuntu3
    • 2.0.0~rc3-0ubuntu1
    • 2.0.0~rc3-0ubuntu2
    • 2.0.0~rc3-0ubuntu3
    • 2.0.0~rc3-0ubuntu4
    • 2.0.0~rc4-0ubuntu1
    • 2.0.0~rc5-0ubuntu1
    • 2.0.0~rc6-0ubuntu1
    • 2.0.0~rc6-0ubuntu2
    • 2.0.0~rc7-0ubuntu1
    • 2.0.0~rc7-0ubuntu2
    • 2.0.0~rc8-0ubuntu1
    • 2.0.0~rc8-0ubuntu2
    • 2.0.0~rc8-0ubuntu3
    • 2.0.0~rc8-0ubuntu5
    • 2.0.0~rc8-0ubuntu6
    • 2.0.0~rc8-0ubuntu7
    • 2.0.0~rc9-0ubuntu2
    • 2.0.0~rc9-0ubuntu3
    • 2.0.0~rc9-0ubuntu4
    • 2.0.0~rc9-0ubuntu5
    • 2.0.0-0ubuntu1
    • 2.0.0-0ubuntu2
    • 2.0.0-0ubuntu3
    • 2.0.0-0ubuntu4
    • 2.0.1-0ubuntu1~16.04.1
    • 2.0.2-0ubuntu1~16.04.1
    • 2.0.3-0ubuntu1~ubuntu16.04.2
    • 2.0.4-0ubuntu1~ubuntu16.04.1
    • 2.0.5-0ubuntu1~ubuntu16.04.1
    • 2.0.8-0ubuntu1~ubuntu16.04.1
    • 2.0.8-0ubuntu1~ubuntu16.04.2
    • 2.0.9-0ubuntu1~16.04.1
    • 2.0.9-0ubuntu1~16.04.2
    • 2.0.10-0ubuntu1~16.04.1
    • 2.0.10-0ubuntu1~16.04.2
    • 2.0.11-0ubuntu1~16.04.2
    • 2.0.11-0ubuntu1~16.04.4
    • 2.0.11-0ubuntu1~16.04.4+esm1
    • 2.0.11-0ubuntu1~16.04.4+esm2
    • 2.0.11-0ubuntu1~16.04.4+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • containerd Ubuntu:Pro:16.04:LTS

    Versions
    • 0.2.1-0ubuntu4~16.04
    • 0.2.3-0ubuntu1~16.04
    • 0.2.5-0ubuntu1~16.04.1
    • 1.2.6-0ubuntu1~16.04.2
    • 1.2.6-0ubuntu1~16.04.3
    • 1.2.6-0ubuntu1~16.04.4
    • 1.2.6-0ubuntu1~16.04.5
    • 1.2.6-0ubuntu1~16.04.6
    • 1.2.6-0ubuntu1~16.04.6+esm1
    • 1.2.6-0ubuntu1~16.04.6+esm2
    • 1.2.6-0ubuntu1~16.04.6+esm4
    • 1.2.6-0ubuntu1~16.04.6+esm5
    • 1.2.6-0ubuntu1~16.04.6+esm6
    • 1.2.6-0ubuntu1~16.04.6+esm7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.8-1ubuntu1~16.04.2
    • 1.13.8-1ubuntu1~16.04.3
    • 1.13.8-1ubuntu1~16.04.3+esm2
    • 1.13.8-1ubuntu1~16.04.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.18.1-1ubuntu1~16.04.6
    • 1.18.1-1ubuntu1~16.04.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:16.04:LTS

    Versions
    • 20201217.02-0ubuntu1~16.04.0
    • 20230426.00-0ubuntu2~16.04.3
    • 20231004.02-0ubuntu1~16.04.1
    • 20231004.02-0ubuntu1~16.04.2
    • 20240716.00-0ubuntu1~16.04.0
    • 20240716.00-0ubuntu1~16.04.0+esm1
    • 20240716.00-0ubuntu1~16.04.0+esm2
    • 20240716.00-0ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-osconfig-agent Ubuntu:Pro:16.04:LTS

    Versions
    • 20210219.00-0ubuntu1~16.04.0
    • 20230504.00-0ubuntu1~16.04.0
    • 20240320.00-0ubuntu1~16.04.0
    • 20240524.03-0ubuntu2~16.04.0
    • 20251028.00-0ubuntu2~16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:18.04:LTS

    Versions
    • 1.10~rc1-1
    • 1.10~rc1-1ubuntu1
    • 1.10~rc1-2ubuntu1
    • 1.10~rc2-1ubuntu1
    • 1.10-1ubuntu1
    • 1.10.1-1ubuntu2
    • 1.10.4-2ubuntu1~18.04.1
    • 1.10.4-2ubuntu1~18.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lxd Ubuntu:Pro:18.04:LTS

    Versions
    • 2.18-0ubuntu6
    • 2.19-0ubuntu1
    • 2.20-0ubuntu3
    • 2.20-0ubuntu4
    • 2.21-0ubuntu1
    • 2.21-0ubuntu2
    • 2.21-0ubuntu3
    • 2.21-0ubuntu4
    • 3.0.0~beta2-0ubuntu3
    • 3.0.0~beta3-0ubuntu3
    • 3.0.0~beta5-0ubuntu2
    • 3.0.0~beta7-0ubuntu1
    • 3.0.0-0ubuntu1
    • 3.0.0-0ubuntu2
    • 3.0.0-0ubuntu3
    • 3.0.0-0ubuntu4
    • 3.0.1-0ubuntu1~18.04.1
    • 3.0.2-0ubuntu1~18.04.1
    • 3.0.3-0ubuntu1~18.04.1
    • 3.0.3-0ubuntu1~18.04.2
    • 3.0.3-0ubuntu1~18.04.2+esm1
    • 3.0.3-0ubuntu1~18.04.2+esm2
    • 3.0.3-0ubuntu1~18.04.2+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • containerd Ubuntu:Pro:18.04:LTS

    Versions
    • 0.2.5-0ubuntu2
    • 1.2.6-0ubuntu1~18.04.1
    • 1.2.6-0ubuntu1~18.04.2
    • 1.3.3-0ubuntu1~18.04.1
    • 1.3.3-0ubuntu1~18.04.2
    • 1.3.3-0ubuntu1~18.04.3
    • 1.3.3-0ubuntu1~18.04.4
    • 1.4.4-0ubuntu1~18.04.2
    • 1.5.2-0ubuntu1~18.04.1
    • 1.5.2-0ubuntu1~18.04.2
    • 1.5.2-0ubuntu1~18.04.3
    • 1.5.5-0ubuntu3~18.04.1
    • 1.5.5-0ubuntu3~18.04.2
    • 1.5.9-0ubuntu1~18.04.1
    • 1.5.9-0ubuntu1~18.04.2
    • 1.6.12-0ubuntu1~18.04.1
    • 1.6.12-0ubuntu1~18.04.1+esm1
    • 1.6.12-0ubuntu1~18.04.1+esm2
    • 1.6.12-0ubuntu1~18.04.1+esm3
    • 1.6.12-0ubuntu1~18.04.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →