https://seclists.org/oss-sec/2026/q4/102: Fwd: Vulnerabilities in golang.org/x/net
Published Oct 8, 2026
·Updated
Affected Software
1 affected component
go/golang.org/x/net
Frequently Asked Questions
1
Which deployments are exposed to this issue?
HTTP/2 servers using golang.org/x/net are exposed. HTTP/1 servers are not susceptible to this exploit because they cannot multiplex a large number of requests over one TCP connection and calculate Server.MaxHeaderBytes differently.
2
What must an attacker do to trigger the memory exhaustion?
An attacker needs to send HTTP/2 requests with a Trailer header declaring a large number of fields. Each declared field creates an entry in Request.Trailer, causing disproportionate memory allocation.
3
Do Server.MaxHeaderValueCount and Server.MaxHeaderBytes prevent exploitation?
Before the change described in the advisory, those limits could be bypassed through trailer fields declared in Trailer headers. The updated behavior applies both limits to declared trailer fields.