CVE-2026-78669

Summary

A malicious HTTP/2 peer can exhaust CPU resources by creating numerous streams and sending frequent SETTINGS frames with small window sizes, leading to excessive processing overhead. This vulnerability allows attackers to cause significant performance degradation without requiring authentication or user interaction.

Exploitability

Exploitation is relatively straightforward requiring only an HTTP/2 connection with a malicious peer that opens many streams and sends frequent SETTINGS frames, with no additional preconditions needed.

Blast radius

The impact could affect any HTTP/2 server or client under attack, potentially causing denial of service through excessive CPU consumption and degraded performance for legitimate users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to nghttp2 version 1.59.0 or later to address this CPU exhaustion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.