CVE-2026-56853: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Published Aug 13, 2026

Updated

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Event History

Aug 13, 2026

CVE Published

via MITRE·09:58 PM

Data Sourced

via MITRE·09:58 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-56853?

CVE-2026-56853 has a risk rating of 23, indicating a potential medium level of severity.

How does CVE-2026-56853 impact unencrypted HTTP/2 connections?

CVE-2026-56853 impacts unencrypted HTTP/2 connections by not applying ReadHeaderTimeout when reading client preface bytes.

What environments are affected by CVE-2026-56853?

CVE-2026-56853 affects servers configured to support unencrypted HTTP/2 connections.

How can I mitigate CVE-2026-56853?

Mitigation for CVE-2026-56853 would involve ensuring proper timeout settings for HTTP/2 connection handling.

What is the main issue described in CVE-2026-56853?

The main issue in CVE-2026-56853 is that ReadHeaderTimeout is not enforced when checking for the HTTP/2 client preface.

CVE-2026-56853: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-56853?

How does CVE-2026-56853 impact unencrypted HTTP/2 connections?

What environments are affected by CVE-2026-56853?

How can I mitigate CVE-2026-56853?

What is the main issue described in CVE-2026-56853?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-56853?

How does CVE-2026-56853 impact unencrypted HTTP/2 connections?

What environments are affected by CVE-2026-56853?

How can I mitigate CVE-2026-56853?

What is the main issue described in CVE-2026-56853?