Go/golang.org/x/net CVE-2026-97032: unknown, EPSS 0.49%

HTTP/2 server crash due to HPACK encoder race in net/http

Action: Upgrade golang.org/x/net to 0.60.0 or later.

go get golang.org/x/net@v0.60.0

Affected

Fixed versions

Sources

• osv: GO-2026-6617#Go/golang.org/x/net
• https://go.dev/cl/847188
• https://go.dev/cl/847313
• https://go.dev/issue/81867
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

CVE-2026-97032 · published 2026-10-08T22:31:09Z · modified 2026-10-16T09:55:57.350751224Z · JSON