CVE-2026-97032 Go CVE debrief

Who should care

Defenders responsible for Go-based HTTP/2 server deployments, especially those using the Go net/http package, should assess their exposure to this vulnerability and prioritize verification and potential updates. This includes operators managing HTTP/2 servers, platform administrators, vulnerability management teams, and security teams that need to ensure the integrity of their server infrastructure.

Why it matters

This vulnerability in the Go net/http package can lead to HTTP/2 server crashes, potentially allowing for denial-of-service (DoS) attacks. Defenders should verify exposure in their deployments and prioritize updates or patches.

• Server crashes due to concurrent modification of the HPACK encoder
• Potential for denial-of-service (DoS) attacks through exploitation of this vulnerability
• Need for verification of exposure in HTTP/2 server deployments using the Go net/http package
• Priority for updating or patching vulnerable versions of the Go net/http package

Technical summary

The Go net/http package has a vulnerability in the HPACK encoder used for HTTP/2. The server modifies the HPACK encoder from two goroutines without synchronization: one for encoding a HEADERS frame as part of a response to a client and the other for modifying the encoder's table size when handling a SETTINGS frame from a client. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Defensive priority

Defenders should prioritize verifying exposure in their HTTP/2 server deployments, especially those using the Go net/http package, and assess the need for updates or patches.

Recommended defensive actions

• Verify the version of the Go net/http package in use and update to a patched version if necessary.
• Assess the exposure of HTTP/2 server deployments to this vulnerability.
• Monitor for any malicious client activity that could exploit this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The evidence is based on the official CVE record and the source item from osv_dev, which provides details about the vulnerability in the Go net/http package. Defenders should verify the version of the Go net/http package in use and assess exposure in their HTTP/2 server deployments. The CVE record was published on 2026-10-08T22:31:09.000Z and has not been modified since then. No additional information is available about the scope of affected systems or specific attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.