HTTP/2 server memory exhaustion due to Trailer headers in net/http

{
  "id": "832165895db73b3518981b96b60b3e6d2386f3eedecb6929d586fc25d1e5a71f",
  "url": "https://osv.dev/vulnerability/GO-2026-6603",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HTTP/2 server memory exhaustion due to Trailer headers in net/http",
    "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.",
    "evidence": "osv:GO-2026-6603",
    "products": [
      {
        "name": {
          "value": "stdlib",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.26.9",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "stdlib",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.27.2",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "golang.org/x/net",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.60.0",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6603",
      "aliases": [
        "BIT-golang-2026-78659",
        "CVE-2026-78659",
        "GO-2026-6603"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.26.9"
                }
              ]
            }
          ],
          "package": {
            "name": "stdlib",
            "purl": "pkg:golang/stdlib",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6603.json"
          },
          "ecosystem_specific": {
            "imports": [
              {
                "path": "net/http",
                "symbols": [
                  "CanonicalHeaderKey",
                  "Client.CloseIdleConnections",
                  "Client.Do",
                  "Client.Get",
                  "Client.Head",
                  "Client.Post",
                  "Client.PostForm",
                  "ClientConn.Close",
                  "ClientConn.RoundTrip",
                  "Cookie.String",
                  "Cookie.Valid",
                  "CrossOriginProtection.AddInsecureBypassPattern",
                  "CrossOriginProtection.AddTrustedOrigin",
                  "CrossOriginProtection.Check",
                  "Dir.Open",
                  "Error",
                  "Get",
                  "Handle",
                  "HandleFunc",
                  "HandlerFunc.ServeHTTP",
                  "Head",
                  "Header.Add",
                  "Header.Del",
                  "Header.Get",
                  "Header.Set",
                  "Header.Values",
                  "Header.Write",
                  "Header.WriteSubset",
                  "ListenAndServe",
                  "ListenAndServeTLS",
                  "NewRequest",
                  "NewRequestWithContext",
                  "NotFound",
                  "ParseCookie",
                  "ParseSetCookie",
                  "ParseTime",
                  "Post",
                  "PostForm",
                  "ProxyFromEnvironment",
                  "ReadRequest",
                  "ReadResponse",
                  "Redirect",
                  "Request.AddCookie",
                  "Request.BasicAuth",
                  "Request.Cookie",
                  "Request.Cookies",
                  "Request.CookiesNamed",
                  "Request.FormFile",
                  "Request.FormValue",
                  "Request.MultipartReader",
                  "Request.ParseForm",
                  "Request.ParseMultipartForm",
                  "Request.PostFormValue",
                  "Request.Referer",
                  "Request.SetBasicAuth",
                  "Request.UserAgent",
                  "Request.Write",
                  "Request.WriteProxy",
                  "Response.Cookies",
                  "Response.Location",
                  "Response.Write",
                  "ResponseController.EnableFullDuplex",
                  "ResponseController.Flush",
                  "ResponseController.Hijack",
                  "ResponseController.SetReadDeadline",
                  "ResponseController.SetWriteDeadline",
                  "Serve",
                  "ServeContent",
                  "ServeFile",
                  "ServeFileFS",
                  "ServeMux.Handle",
                  "ServeMux.HandleFunc",
                  "ServeMux.ServeHTTP",
                  "ServeTLS",
                  "Server.Close",
                  "Server.ListenAndServe",
                  "Server.ListenAndServeTLS",
                  "Server.Serve",
                  "Server.ServeTLS",
                  "Server.SetKeepAlivesEnabled",
                  "Server.Shutdown",
                  "SetCookie",
                  "Transport.CancelRequest",
                  "Transport.Clone",
                  "Transport.CloseIdleConnections",
                  "Transport.NewClientConn",
                  "Transport.RoundTrip",
                  "body.Close",
                  "body.Read",
                  "bodyEOFSignal.Close",
                  "bodyEOFSignal.Read",
                  "bodyLocked.Read",
                  "bufioFlushWriter.Write",
                  "cancelTimerBody.Close",
                  "cancelTimerBody.Read",
                  "checkConnErrorWriter.Write",
                  "chunkWriter.Write",
                  "connReader.Read",
                  "connectMethodKey.String",
                  "expectContinueReader.Close",
                  "expectContinueReader.Read",
                  "extraHeader.Write",
                  "fileHandler.ServeHTTP",
                  "fileTransport.RoundTrip",
                  "globalOptionsHandler.ServeHTTP",
                  "gzipReader.Close",
                  "gzipReader.Read",
                  "http1ClientConn.Close",
                  "http1ClientConn.RoundTrip",
                  "http2ClientConn.Close",
                  "http2ClientConn.Ping",
                  "http2ClientConn.RoundTrip",
                  "http2ClientConn.Shutdown",
                  "http2ConnectionError.Error",
                  "http2ErrCode.String",
                  "http2FrameHeader.String",
                  "http2FrameType.String",
                  "http2FrameWriteRequest.String",
                  "http2Framer.ReadFrame",
                  "http2Framer.ReadFrameForHeader",
                  "http2Framer.ReadFrameHeader",
                  "http2Framer.WriteContinuation",
                  "http2Framer.WriteData",
                  "http2Framer.WriteDataPadded",
                  "http2Framer.WriteGoAway",
                  "http2Framer.WriteHeaders",
                  "http2Framer.WritePing",
                  "http2Framer.WritePriority",
                  "http2Framer.WritePushPromise",
                  "http2Framer.WriteRSTStream",
                  "http2Framer.WriteRawFrame",
                  "http2Framer.WriteSettings",
                  "http2Framer.WriteSettingsAck",
                  "http2Framer.WriteWindowUpdate",
                  "http2Framer.readMetaFrame",
                  "http2GoAwayError.Error",
                  "http2Server.ServeConn",
                  "http2Setting.String",
                  "http2SettingID.String",
                  "http2SettingsFrame.ForeachSetting",
                  "http2StreamError.Error",
                  "http2Transport.CloseIdleConnections",
                  "http2Transport.NewClientConn",
                  "http2Transport.RoundTrip",
                  "http2Transport.RoundTripOpt",
                  "http2bufferedWriter.Flush",
                  "http2bufferedWriter.Write",
                  "http2bufferedWriterTimeoutWriter.Write",
                  "http2chunkWriter.Write",
                  "http2clientConnPool.GetClientConn",
                  "http2connError.Error",
                  "http2dataBuffer.Read",
                  "http2duplicatePseudoHeaderError.Error",
                  "http2gzipReader.Close",
                  "http2gzipReader.Read",
                  "http2headerFieldNameError.Error",
                  "http2headerFieldValueError.Error",
                  "http2netHTTPClientConn.Close",
                  "http2netHTTPClientConn.RoundTrip",
                  "http2noDialClientConnPool.GetClientConn",
                  "http2noDialH2RoundTripper.NewClientConn",
                  "http2noDialH2RoundTripper.RoundTrip",
                  "http2pipe.Read",
                  "http2priorityWriteSchedulerRFC7540.CloseStream",
                  "http2priorityWriteSchedulerRFC7540.OpenStream",
                  "http2priorityWriteSchedulerRFC9218.OpenStream",
                  "http2pseudoHeaderError.Error",
                  "http2requestBody.Close",
                  "http2requestBody.Read",
                  "http2responseWriter.Flush",
                  "http2responseWriter.FlushError",
                  "http2responseWriter.Push",
                  "http2responseWriter.SetReadDeadline",
                  "http2responseWriter.SetWriteDeadline",
                  "http2responseWriter.Write",
                  "http2responseWriter.WriteHeader",
                  "http2responseWriter.WriteString",
                  "http2roundRobinWriteScheduler.OpenStream",
                  "http2serverConn.CloseConn",
                  "http2serverConn.Flush",
                  "http2stickyErrWriter.Write",
                  "http2transportResponseBody.Close",
                  "http2transportResponseBody.Read",
                  "http2unencryptedTransport.RoundTrip",
                  "http2writeData.String",
                  "initALPNRequest.ServeHTTP",
                  "loggingConn.Close",
                  "loggingConn.Read",
                  "loggingConn.Write",
                  "maxBytesReader.Close",
                  "maxBytesReader.Read",
                  "onceCloseListener.Close",
                  "persistConn.Read",
                  "persistConnWriter.ReadFrom",
                  "persistConnWriter.Write",
                  "populateResponse.Write",
                  "populateResponse.WriteHeader",
                  "readTrackingBody.Close",
                  "readTrackingBody.Read",
                  "readWriteCloserBody.CloseWrite",
                  "readWriteCloserBody.Read",
                  "redirectHandler.ServeHTTP",
                  "response.Flush",
                  "response.FlushError",
                  "response.Hijack",
                  "response.ReadFrom",
                  "response.Write",
                  "response.WriteHeader",
                  "response.WriteString",
                  "serverHandler.ServeHTTP",
                  "socksDialer.DialWithConn",
                  "socksUsernamePassword.Authenticate",
                  "stringWriter.WriteString",
                  "timeoutHandler.ServeHTTP",
                  "timeoutWriter.Write",
                  "timeoutWriter.WriteHeader",
                  "transportReadFromServerError.Error",
                  "unencryptedHTTP2Request.ServeHTTP"
                ]
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.27.0-0"
                },
                {
                  "fixed": "1.27.2"
                }
              ]
            }
          ],
          "package": {
            "name": "stdlib",
            "purl": "pkg:golang/stdlib",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6603.json"
          },
          "ecosystem_specific": {
            "imports": [
              {
                "path": "net/http/internal/http2",
                "symbols": [
                  "ClientConn.Close",
                  "ClientConn.Ping",
                  "ClientConn.RoundTrip",
                  "ClientConn.Shutdown",
                  "Framer.ReadFrame",
                  "Framer.ReadFrameForHeader",
                  "Framer.ReadFrameHeader",
                  "Framer.WriteContinuation",
                  "Framer.WriteData",
                  "Framer.WriteDataPadded",
                  "Framer.WriteGoAway",
                  "Framer.WriteHeaders",
                  "Framer.WritePing",
                  "Framer.WritePriority",
                  "Framer.WritePriorityUpdate",
                  "Framer.WritePushPromise",
                  "Framer.WriteRSTStream",
                  "Framer.WriteRawFrame",
                  "Framer.WriteSettings",
                  "Framer.WriteSettingsAck",
                  "Framer.WriteWindowUpdate",
                  "Framer.readMetaFrame",
                  "NetHTTPClientConn.Close",
                  "NetHTTPClientConn.Ping",
                  "NetHTTPClientConn.RoundTrip",
                  "ReadFrameHeader",
                  "Server.GracefulShutdown",
                  "Server.ServeConn",
                  "SettingsFrame.ForeachSetting",
                  "Transport.AddConn",
                  "Transport.CloseIdleConnections",
                  "Transport.NewClientConn",
                  "Transport.RoundTrip",
                  "Transport.RoundTripOpt",
                  "bufferedWriter.Flush",
                  "bufferedWriter.Write",
                  "bufferedWriterTimeoutWriter.Write",
                  "chunkWriter.Write",
                  "clientConnPool.GetClientConn",
                  "gzipReader.Close",
                  "gzipReader.Read",
                  "noDialClientConnPool.GetClientConn",
                  "requestBody.Close",
                  "responseWriter.Flush",
                  "responseWriter.FlushError",
                  "responseWriter.Push",
                  "responseWriter.Write",
                  "responseWriter.WriteHeader",
                  "responseWriter.WriteString",
                  "serve400Handler.ServeHTTP",
                  "serverConn.Flush",
                  "stickyErrWriter.Write",
                  "transportResponseBody.Close",
                  "transportResponseBody.Read"
                ]
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.60.0"
                }
              ]
            }
          ],
          "package": {
            "name": "golang.org/x/net",
            "purl": "pkg:golang/golang.org/x/net",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6603.json"
          },
          "ecosystem_specific": {
            "imports": [
              {
                "path": "golang.org/x/net/http2",
                "symbols": [
                  "ClientConn.Close",
                  "ClientConn.Ping",
                  "ClientConn.RoundTrip",
                  "ClientConn.Shutdown",
                  "ConfigureServer",
                  "ConfigureTransport",
                  "ConfigureTransports",
                  "ConnectionError.Error",
                  "ErrCode.String",
                  "FrameHeader.String",
                  "FrameType.String",
                  "FrameWriteRequest.String",
                  "Framer.ReadFrame",
                  "Framer.ReadFrameForHeader",
                  "Framer.ReadFrameHeader",
                  "Framer.WriteContinuation",
                  "Framer.WriteData",
                  "Framer.WriteDataPadded",
                  "Framer.WriteGoAway",
                  "Framer.WriteHeaders",
                  "Framer.WritePing",
                  "Framer.WritePriority",
                  "Framer.WritePriorityUpdate",
                  "Framer.WritePushPromise",
                  "Framer.WriteRSTStream",
                  "Framer.WriteRawFrame",
                  "Framer.WriteSettings",
                  "Framer.WriteSettingsAck",
                  "Framer.WriteWindowUpdate",
                  "Framer.readMetaFrame",
                  "GoAwayError.Error",
                  "ReadFrameHeader",
                  "Server.ServeConn",
                  "Setting.String",
                  "SettingID.String",
                  "SettingsFrame.ForeachSetting",
                  "StreamError.Error",
                  "Transport.CloseIdleConnections",
                  "Transport.NewClientConn",
                  "Transport.RoundTrip",
                  "Transport.RoundTripOpt",
                  "bufferedWriter.Flush",
                  "bufferedWriter.Write",
                  "bufferedWriterTimeoutWriter.Write",
                  "chunkWriter.Write",
                  "clientConnPool.GetClientConn",
                  "connError.Error",
                  "dataBuffer.Read",
                  "duplicatePseudoHeaderError.Error",
                  "gzipReader.Close",
                  "gzipReader.Read",
                  "headerFieldNameError.Error",
                  "headerFieldValueError.Error",
                  "netHTTPClientConn.Close",
                  "netHTTPClientConn.RoundTrip",
                  "noDialClientConnPool.GetClientConn",
                  "noDialH2RoundTripper.NewClientConn",
                  "noDialH2RoundTripper.RoundTrip",
                  "pipe.Read",
                  "priorityWriteSchedulerRFC7540.CloseStream",
                  "priorityWriteSchedulerRFC7540.OpenStream",
                  "priorityWriteSchedulerRFC9218.OpenStream",
                  "pseudoHeaderError.Error",
                  "requestBody.Close",
                  "requestBody.Read",
                  "responseWriter.Flush",
                  "responseWriter.FlushError",
                  "responseWriter.Push",
                  "responseWriter.SetReadDeadline",
                  "responseWriter.SetWriteDeadline",
                  "responseWriter.Write",
                  "responseWriter.WriteHeader",
                  "responseWriter.WriteString",
                  "roundRobinWriteScheduler.OpenStream",
                  "serverConn.CloseConn",
                  "serverConn.Flush",
                  "stickyErrWriter.Write",
                  "transportResponseBody.Close",
                  "transportResponseBody.Read",
                  "unencryptedTransport.RoundTrip",
                  "writeData.String"
                ]
              }
            ]
          }
        }
      ],
      "modified": "2026-10-16T09:55:47.068117441Z",
      "provider": "osv",
      "references": [
        "https://go.dev/cl/847185",
        "https://go.dev/cl/847314",
        "https://go.dev/issue/81857",
        "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
        "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6603",
        "review_status": "REVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-78659",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 338710,
  "published_at": "2026-10-08T22:31:09+00:00"
}