Go/golang.org/x/net CVE-2026-78669: high 7.5, EPSS 0.61%

Excessive CPU consumption from repeated initial window changes in net/http

Action: Upgrade golang.org/x/net to 0.60.0 or later.

go get golang.org/x/net@v0.60.0

Affected

Fixed versions

Sources

• osv: GO-2026-6611#Go/golang.org/x/net
• nvd: CVE-2026-78669
• https://go.dev/cl/847186
• https://go.dev/cl/847308
• https://go.dev/issue/81742
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

CVE-2026-78669 · published 2026-10-08T22:31:09Z · modified 2026-10-16T09:55:38.952277866Z · JSON