CVE-2026-56853: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Other sources
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56853?
CVE-2026-56853 has a risk rating of 23, indicating a potential medium level of severity.
How does CVE-2026-56853 impact unencrypted HTTP/2 connections?
CVE-2026-56853 impacts unencrypted HTTP/2 connections by not applying ReadHeaderTimeout when reading client preface bytes.
What environments are affected by CVE-2026-56853?
CVE-2026-56853 affects servers configured to support unencrypted HTTP/2 connections.
How can I mitigate CVE-2026-56853?
Mitigation for CVE-2026-56853 would involve ensuring proper timeout settings for HTTP/2 connection handling.
What is the main issue described in CVE-2026-56853?
The main issue in CVE-2026-56853 is that ReadHeaderTimeout is not enforced when checking for the HTTP/2 client preface.