https://seclists.org/oss-sec/2026/q4/101: Fwd: Go 1.27.2 and Go 1.26.9 aleased

Q: What does an attacker need to do to trigger the crash?

A malicious HTTP/2 client needs to repeatedly send requests while changing the HPACK header-table size through SETTINGS_HEADER_TABLE_SIZE frames. This can cause concurrent modification of the server's HPACK encoder.

Q: What is the practical impact on a vulnerable service?

The HTTP/2 server can crash. The issue is caused by an unsynchronized race between response HEADERS encoding and processing a client-supplied SETTINGS_HEADER_TABLE_SIZE value.

Q: How is the issue remediated?

Update to Go 1.27.2 or Go 1.26.9, as appropriate for the deployed release line. The fix buffers received SETTINGS_HEADER_TABLE_SIZE values and applies them before the next server frame write rather than immediately.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Google Go<1.27.2, <1.26.9

Frequently Asked Questions

What does an attacker need to do to trigger the crash?

A malicious HTTP/2 client needs to repeatedly send requests while changing the HPACK header-table size through SETTINGS_HEADER_TABLE_SIZE frames. This can cause concurrent modification of the server's HPACK encoder.

What is the practical impact on a vulnerable service?

The HTTP/2 server can crash. The issue is caused by an unsynchronized race between response HEADERS encoding and processing a client-supplied SETTINGS_HEADER_TABLE_SIZE value.

How is the issue remediated?