CVE-2026-78659

Summary

An HTTP/2 server vulnerability where malicious clients can send Trailer headers with excessive field counts, causing disproportionate memory allocation while bypassing existing header limits. This allows attackers to consume server resources without triggering typical header size alarms.

Exploitability

Exploitation requires a malicious client connecting over HTTP/2 with a Trailer header containing many fields, making it moderately difficult but possible for attackers who can control HTTP/2 connections.

Blast radius

The vulnerability could lead to significant server resource exhaustion across multiple concurrent HTTP/2 connections, potentially causing denial of service for legitimate users.

Detection

Monitor HTTP/2 connection logs for unusually high numbers of trailer fields in requests, particularly when processing Trailer headers with more than 100 fields per request.

Prioritized remediation

Upgrade to Go 1.23.5 or later, which includes the fix for this memory allocation issue in HTTP/2 trailer handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.