CVE-2026-56853: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Published Aug 13, 2026
·Updated
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
Affected Software
1 affected component
go net/http
Event History
Aug 13, 2026
CVE Published
via MITRE·09:58 PM
Data Sourced
via MITRE·09:58 PM
DescriptionWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·10:21 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-56853?
CVE-2026-56853 has a risk rating of 23, indicating a potential medium level of severity.
2
How does CVE-2026-56853 impact unencrypted HTTP/2 connections?
CVE-2026-56853 impacts unencrypted HTTP/2 connections by not applying ReadHeaderTimeout when reading client preface bytes.
3
What environments are affected by CVE-2026-56853?
CVE-2026-56853 affects servers configured to support unencrypted HTTP/2 connections.
4
How can I mitigate CVE-2026-56853?
Mitigation for CVE-2026-56853 would involve ensuring proper timeout settings for HTTP/2 connection handling.
5
What is the main issue described in CVE-2026-56853?
The main issue in CVE-2026-56853 is that ReadHeaderTimeout is not enforced when checking for the HTTP/2 client preface.