CVE-2026-78663

Summary

A HTTP/2 server incorrectly refunds connection-level flow control twice for the same data, allowing a malicious client to bypass configured connection-level flow control limits. This creates a potential for resource exhaustion and denial of service.

Exploitability

Exploitation requires a malicious client capable of managing HTTP/2 streams and resetting them, with no other preconditions needed beyond standard HTTP/2 support.

Blast radius

If exploited, this flaw could allow an attacker to overwhelm server resources through excessive buffering, potentially leading to service disruption or denial of service across affected connections.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.590 or later to fix the double refund issue in HTTP/2 flow control implementation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.