Go/golang.org/x/net CVE-2026-78659: unknown, EPSS 0.63%

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Action: Upgrade golang.org/x/net to 0.60.0 or later.

go get golang.org/x/net@v0.60.0

Affected

Fixed versions

Sources

• osv: GO-2026-6603#Go/golang.org/x/net
• https://go.dev/cl/847185
• https://go.dev/cl/847314
• https://go.dev/issue/81857
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

CVE-2026-78659 · published 2026-10-08T22:31:09Z · modified 2026-10-16T09:55:47.068117441Z · JSON