{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97032", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-09-23T23:03:58.333Z", "datePublished": "2026-10-08T22:54:00.230Z", "dateUpdated": "2026-10-15T15:46:39.417Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-10-08T22:54:00.230Z"}, "title": "HTTP/2 server crash due to HPACK encoder race in net/http", "descriptions": [{"lang": "en", "value": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}], "affected": [{"vendor": "Go standard library", "product": "net/http", "collectionURL": "https://pkg.go.dev", "packageName": "net/http", "versions": [{"version": "0", "lessThan": "1.26.9", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "http2serverConn.processSetting"}, {"name": "http2serverConn.startFrameWrite"}, {"name": "CanonicalHeaderKey"}, {"name": "Client.CloseIdleConnections"}, {"name": "Client.Do"}, {"name": "Client.Get"}, {"name": "Client.Head"}, {"name": "Client.Post"}, {"name": "Client.PostForm"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.RoundTrip"}, {"name": "Cookie.String"}, {"name": "Cookie.Valid"}, {"name": "CrossOriginProtection.AddInsecureBypassPattern"}, {"name": "CrossOriginProtection.AddTrustedOrigin"}, {"name": "CrossOriginProtection.Check"}, {"name": "Dir.Open"}, {"name": "Error"}, {"name": "Get"}, {"name": "Handle"}, {"name": "HandleFunc"}, {"name": "HandlerFunc.ServeHTTP"}, {"name": "Head"}, {"name": "Header.Add"}, {"name": "Header.Del"}, {"name": "Header.Get"}, {"name": "Header.Set"}, {"name": "Header.Values"}, {"name": "Header.Write"}, {"name": "Header.WriteSubset"}, {"name": "ListenAndServe"}, {"name": "ListenAndServeTLS"}, {"name": "NewRequest"}, {"name": "NewRequestWithContext"}, {"name": "NotFound"}, {"name": "ParseCookie"}, {"name": "ParseSetCookie"}, {"name": "ParseTime"}, {"name": "Post"}, {"name": "PostForm"}, {"name": "ProxyFromEnvironment"}, {"name": "ReadRequest"}, {"name": "ReadResponse"}, {"name": "Redirect"}, {"name": "Request.AddCookie"}, {"name": "Request.BasicAuth"}, {"name": "Request.Cookie"}, {"name": "Request.Cookies"}, {"name": "Request.CookiesNamed"}, {"name": "Request.FormFile"}, {"name": "Request.FormValue"}, {"name": "Request.MultipartReader"}, {"name": "Request.ParseForm"}, {"name": "Request.ParseMultipartForm"}, {"name": "Request.PostFormValue"}, {"name": "Request.Referer"}, {"name": "Request.SetBasicAuth"}, {"name": "Request.UserAgent"}, {"name": "Request.Write"}, {"name": "Request.WriteProxy"}, {"name": "Response.Cookies"}, {"name": "Response.Location"}, {"name": "Response.Write"}, {"name": "ResponseController.EnableFullDuplex"}, {"name": "ResponseController.Flush"}, {"name": "ResponseController.Hijack"}, {"name": "ResponseController.SetReadDeadline"}, {"name": "ResponseController.SetWriteDeadline"}, {"name": "Serve"}, {"name": "ServeContent"}, {"name": "ServeFile"}, {"name": "ServeFileFS"}, {"name": "ServeMux.Handle"}, {"name": "ServeMux.HandleFunc"}, {"name": "ServeMux.ServeHTTP"}, {"name": "ServeTLS"}, {"name": "Server.Close"}, {"name": "Server.ListenAndServe"}, {"name": "Server.ListenAndServeTLS"}, {"name": "Server.Serve"}, {"name": "Server.ServeTLS"}, {"name": "Server.SetKeepAlivesEnabled"}, {"name": "Server.Shutdown"}, {"name": "SetCookie"}, {"name": "Transport.CancelRequest"}, {"name": "Transport.Clone"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "body.Close"}, {"name": "body.Read"}, {"name": "bodyEOFSignal.Close"}, {"name": "bodyEOFSignal.Read"}, {"name": "bodyLocked.Read"}, {"name": "bufioFlushWriter.Write"}, {"name": "cancelTimerBody.Close"}, {"name": "cancelTimerBody.Read"}, {"name": "checkConnErrorWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "connReader.Read"}, {"name": "connectMethodKey.String"}, {"name": "expectContinueReader.Close"}, {"name": "expectContinueReader.Read"}, {"name": "extraHeader.Write"}, {"name": "fileHandler.ServeHTTP"}, {"name": "fileTransport.RoundTrip"}, {"name": "globalOptionsHandler.ServeHTTP"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "http1ClientConn.Close"}, {"name": "http1ClientConn.RoundTrip"}, {"name": "http2ClientConn.Close"}, {"name": "http2ClientConn.Ping"}, {"name": "http2ClientConn.RoundTrip"}, {"name": "http2ClientConn.Shutdown"}, {"name": "http2ConnectionError.Error"}, {"name": "http2ErrCode.String"}, {"name": "http2FrameHeader.String"}, {"name": "http2FrameType.String"}, {"name": "http2FrameWriteRequest.String"}, {"name": "http2Framer.ReadFrame"}, {"name": "http2Framer.ReadFrameForHeader"}, {"name": "http2Framer.ReadFrameHeader"}, {"name": "http2Framer.WriteContinuation"}, {"name": "http2Framer.WriteData"}, {"name": "http2Framer.WriteDataPadded"}, {"name": "http2Framer.WriteGoAway"}, {"name": "http2Framer.WriteHeaders"}, {"name": "http2Framer.WritePing"}, {"name": "http2Framer.WritePriority"}, {"name": "http2Framer.WritePushPromise"}, {"name": "http2Framer.WriteRSTStream"}, {"name": "http2Framer.WriteRawFrame"}, {"name": "http2Framer.WriteSettings"}, {"name": "http2Framer.WriteSettingsAck"}, {"name": "http2Framer.WriteWindowUpdate"}, {"name": "http2GoAwayError.Error"}, {"name": "http2Server.ServeConn"}, {"name": "http2Setting.String"}, {"name": "http2SettingID.String"}, {"name": "http2SettingsFrame.ForeachSetting"}, {"name": "http2StreamError.Error"}, {"name": "http2Transport.CloseIdleConnections"}, {"name": "http2Transport.NewClientConn"}, {"name": "http2Transport.RoundTrip"}, {"name": "http2Transport.RoundTripOpt"}, {"name": "http2bufferedWriter.Flush"}, {"name": "http2bufferedWriter.Write"}, {"name": "http2bufferedWriterTimeoutWriter.Write"}, {"name": "http2chunkWriter.Write"}, {"name": "http2clientConnPool.GetClientConn"}, {"name": "http2connError.Error"}, {"name": "http2dataBuffer.Read"}, {"name": "http2duplicatePseudoHeaderError.Error"}, {"name": "http2gzipReader.Close"}, {"name": "http2gzipReader.Read"}, {"name": "http2headerFieldNameError.Error"}, {"name": "http2headerFieldValueError.Error"}, {"name": "http2netHTTPClientConn.Close"}, {"name": "http2netHTTPClientConn.RoundTrip"}, {"name": "http2noDialClientConnPool.GetClientConn"}, {"name": "http2noDialH2RoundTripper.NewClientConn"}, {"name": "http2noDialH2RoundTripper.RoundTrip"}, {"name": "http2pipe.Read"}, {"name": "http2priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "http2priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "http2priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "http2pseudoHeaderError.Error"}, {"name": "http2requestBody.Close"}, {"name": "http2requestBody.Read"}, {"name": "http2responseWriter.Flush"}, {"name": "http2responseWriter.FlushError"}, {"name": "http2responseWriter.Push"}, {"name": "http2responseWriter.SetReadDeadline"}, {"name": "http2responseWriter.SetWriteDeadline"}, {"name": "http2responseWriter.Write"}, {"name": "http2responseWriter.WriteHeader"}, {"name": "http2responseWriter.WriteString"}, {"name": "http2roundRobinWriteScheduler.OpenStream"}, {"name": "http2serverConn.CloseConn"}, {"name": "http2serverConn.Flush"}, {"name": "http2stickyErrWriter.Write"}, {"name": "http2transportResponseBody.Close"}, {"name": "http2transportResponseBody.Read"}, {"name": "http2unencryptedTransport.RoundTrip"}, {"name": "http2writeData.String"}, {"name": "initALPNRequest.ServeHTTP"}, {"name": "loggingConn.Close"}, {"name": "loggingConn.Read"}, {"name": "loggingConn.Write"}, {"name": "maxBytesReader.Close"}, {"name": "maxBytesReader.Read"}, {"name": "onceCloseListener.Close"}, {"name": "persistConn.Read"}, {"name": "persistConnWriter.ReadFrom"}, {"name": "persistConnWriter.Write"}, {"name": "populateResponse.Write"}, {"name": "populateResponse.WriteHeader"}, {"name": "readTrackingBody.Close"}, {"name": "readTrackingBody.Read"}, {"name": "readWriteCloserBody.CloseWrite"}, {"name": "readWriteCloserBody.Read"}, {"name": "redirectHandler.ServeHTTP"}, {"name": "response.Flush"}, {"name": "response.FlushError"}, {"name": "response.Hijack"}, {"name": "response.ReadFrom"}, {"name": "response.Write"}, {"name": "response.WriteHeader"}, {"name": "response.WriteString"}, {"name": "serverHandler.ServeHTTP"}, {"name": "socksDialer.DialWithConn"}, {"name": "socksUsernamePassword.Authenticate"}, {"name": "stringWriter.WriteString"}, {"name": "timeoutHandler.ServeHTTP"}, {"name": "timeoutWriter.Write"}, {"name": "timeoutWriter.WriteHeader"}, {"name": "transportReadFromServerError.Error"}, {"name": "unencryptedHTTP2Request.ServeHTTP"}], "defaultStatus": "unaffected"}, {"vendor": "Go standard library", "product": "net/http/internal/http2", "collectionURL": "https://pkg.go.dev", "packageName": "net/http/internal/http2", "versions": [{"version": "1.27.0-0", "lessThan": "1.27.2", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "serverConn.processSetting"}, {"name": "serverConn.startFrameWrite"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "NetHTTPClientConn.Close"}, {"name": "NetHTTPClientConn.Ping"}, {"name": "NetHTTPClientConn.RoundTrip"}, {"name": "ReadFrameHeader"}, {"name": "Server.GracefulShutdown"}, {"name": "Server.ServeConn"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "Transport.AddConn"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "requestBody.Close"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "serve400Handler.ServeHTTP"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}], "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/net", "product": "golang.org/x/net/http2", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/net/http2", "versions": [{"version": "0", "lessThan": "0.60.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "serverConn.processSetting"}, {"name": "serverConn.startFrameWrite"}, {"name": "ClientConn.Close"}, {"name": "ClientConn.Ping"}, {"name": "ClientConn.RoundTrip"}, {"name": "ClientConn.Shutdown"}, {"name": "ConfigureServer"}, {"name": "ConfigureTransport"}, {"name": "ConfigureTransports"}, {"name": "ConnectionError.Error"}, {"name": "ErrCode.String"}, {"name": "FrameHeader.String"}, {"name": "FrameType.String"}, {"name": "FrameWriteRequest.String"}, {"name": "Framer.ReadFrame"}, {"name": "Framer.ReadFrameForHeader"}, {"name": "Framer.ReadFrameHeader"}, {"name": "Framer.WriteContinuation"}, {"name": "Framer.WriteData"}, {"name": "Framer.WriteDataPadded"}, {"name": "Framer.WriteGoAway"}, {"name": "Framer.WriteHeaders"}, {"name": "Framer.WritePing"}, {"name": "Framer.WritePriority"}, {"name": "Framer.WritePriorityUpdate"}, {"name": "Framer.WritePushPromise"}, {"name": "Framer.WriteRSTStream"}, {"name": "Framer.WriteRawFrame"}, {"name": "Framer.WriteSettings"}, {"name": "Framer.WriteSettingsAck"}, {"name": "Framer.WriteWindowUpdate"}, {"name": "GoAwayError.Error"}, {"name": "ReadFrameHeader"}, {"name": "Server.ServeConn"}, {"name": "Setting.String"}, {"name": "SettingID.String"}, {"name": "SettingsFrame.ForeachSetting"}, {"name": "StreamError.Error"}, {"name": "Transport.CloseIdleConnections"}, {"name": "Transport.NewClientConn"}, {"name": "Transport.RoundTrip"}, {"name": "Transport.RoundTripOpt"}, {"name": "bufferedWriter.Flush"}, {"name": "bufferedWriter.Write"}, {"name": "bufferedWriterTimeoutWriter.Write"}, {"name": "chunkWriter.Write"}, {"name": "clientConnPool.GetClientConn"}, {"name": "connError.Error"}, {"name": "dataBuffer.Read"}, {"name": "duplicatePseudoHeaderError.Error"}, {"name": "gzipReader.Close"}, {"name": "gzipReader.Read"}, {"name": "headerFieldNameError.Error"}, {"name": "headerFieldValueError.Error"}, {"name": "netHTTPClientConn.Close"}, {"name": "netHTTPClientConn.RoundTrip"}, {"name": "noDialClientConnPool.GetClientConn"}, {"name": "noDialH2RoundTripper.NewClientConn"}, {"name": "noDialH2RoundTripper.RoundTrip"}, {"name": "pipe.Read"}, {"name": "priorityWriteSchedulerRFC7540.CloseStream"}, {"name": "priorityWriteSchedulerRFC7540.OpenStream"}, {"name": "priorityWriteSchedulerRFC9218.OpenStream"}, {"name": "pseudoHeaderError.Error"}, {"name": "requestBody.Close"}, {"name": "requestBody.Read"}, {"name": "responseWriter.Flush"}, {"name": "responseWriter.FlushError"}, {"name": "responseWriter.Push"}, {"name": "responseWriter.SetReadDeadline"}, {"name": "responseWriter.SetWriteDeadline"}, {"name": "responseWriter.Write"}, {"name": "responseWriter.WriteHeader"}, {"name": "responseWriter.WriteString"}, {"name": "roundRobinWriteScheduler.OpenStream"}, {"name": "serverConn.CloseConn"}, {"name": "serverConn.Flush"}, {"name": "stickyErrWriter.Write"}, {"name": "transportResponseBody.Close"}, {"name": "transportResponseBody.Read"}, {"name": "unencryptedTransport.RoundTrip"}, {"name": "writeData.String"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "references": [{"url": "https://go.dev/cl/847188"}, {"url": "https://go.dev/cl/847313"}, {"url": "https://go.dev/issue/81867"}, {"url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}, {"url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6617"}], "credits": [{"lang": "en", "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}], "x_gcve": [{"vulnId": "CVE-2026-97032", "recordType": "advisory"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T15:46:16.190858Z", "id": "CVE-2026-97032", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T15:46:39.417Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-97032", "date": "2026-10-22", "epss": "0.0042", "percentile": "0.35228"}, "microsoft_vex": {"current_release_date": "2026-10-14T15:18:53.000Z", "cve": "CVE-2026-97032", "id": "msrc_CVE-2026-97032", "initial_release_date": "2026-10-11T01:40:33.000Z", "product_status:fixed": "5", "product_status:known_affected": "40", "source": "Microsoft CSAF VEX", "status": "final", "title": "HTTP/2 server crash due to HPACK encoder race in net/http", "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97032.json", "version": "3"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-97032\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-10-08T23:17:06.213\",\"lastModified\":\"2026-10-15T16:18:24.967\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go standard library\",\"product\":\"net/http\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"net/http\",\"programRoutines\":[{\"name\":\"http2serverConn.processSetting\"},{\"name\":\"http2serverConn.startFrameWrite\"},{\"name\":\"CanonicalHeaderKey\"},{\"name\":\"Client.CloseIdleConnections\"},{\"name\":\"Client.Do\"},{\"name\":\"Client.Get\"},{\"name\":\"Client.Head\"},{\"name\":\"Client.Post\"},{\"name\":\"Client.PostForm\"},{\"name\":\"ClientConn.Close\"},{\"name\":\"ClientConn.RoundTrip\"},{\"name\":\"Cookie.String\"},{\"name\":\"Cookie.Valid\"},{\"name\":\"CrossOriginProtection.AddInsecureBypassPattern\"},{\"name\":\"CrossOriginProtection.AddTrustedOrigin\"},{\"name\":\"CrossOriginProtection.Check\"},{\"name\":\"Dir.Open\"},{\"name\":\"Error\"},{\"name\":\"Get\"},{\"name\":\"Handle\"},{\"name\":\"HandleFunc\"},{\"name\":\"HandlerFunc.ServeHTTP\"},{\"name\":\"Head\"},{\"name\":\"Header.Add\"},{\"name\":\"Header.Del\"},{\"name\":\"Header.Get\"},{\"name\":\"Header.Set\"},{\"name\":\"Header.Values\"},{\"name\":\"Header.Write\"},{\"name\":\"Header.WriteSubset\"},{\"name\":\"ListenAndServe\"},{\"name\":\"ListenAndServeTLS\"},{\"name\":\"NewRequest\"},{\"name\":\"NewRequestWithContext\"},{\"name\":\"NotFound\"},{\"name\":\"ParseCookie\"},{\"name\":\"ParseSetCookie\"},{\"name\":\"ParseTime\"},{\"name\":\"Post\"},{\"name\":\"PostForm\"},{\"name\":\"ProxyFromEnvironment\"},{\"name\":\"ReadRequest\"},{\"name\":\"ReadResponse\"},{\"name\":\"Redirect\"},{\"name\":\"Request.AddCookie\"},{\"name\":\"Request.BasicAuth\"},{\"name\":\"Request.Cookie\"},{\"name\":\"Request.Cookies\"},{\"name\":\"Request.CookiesNamed\"},{\"name\":\"Request.FormFile\"},{\"name\":\"Request.FormValue\"},{\"name\":\"Request.MultipartReader\"},{\"name\":\"Request.ParseForm\"},{\"name\":\"Request.ParseMultipartForm\"},{\"name\":\"Request.PostFormValue\"},{\"name\":\"Request.Referer\"},{\"name\":\"Request.SetBasicAuth\"},{\"name\":\"Request.UserAgent\"},{\"name\":\"Request.Write\"},{\"name\":\"Request.WriteProxy\"},{\"name\":\"Response.Cookies\"},{\"name\":\"Response.Location\"},{\"name\":\"Response.Write\"},{\"name\":\"ResponseController.EnableFullDuplex\"},{\"name\":\"ResponseController.Flush\"},{\"name\":\"ResponseController.Hijack\"},{\"name\":\"ResponseController.SetReadDeadline\"},{\"name\":\"ResponseController.SetWriteDeadline\"},{\"name\":\"Serve\"},{\"name\":\"ServeContent\"},{\"name\":\"ServeFile\"},{\"name\":\"ServeFileFS\"},{\"name\":\"ServeMux.Handle\"},{\"name\":\"ServeMux.HandleFunc\"},{\"name\":\"ServeMux.ServeHTTP\"},{\"name\":\"ServeTLS\"},{\"name\":\"Server.Close\"},{\"name\":\"Server.ListenAndServe\"},{\"name\":\"Server.ListenAndServeTLS\"},{\"name\":\"Server.Serve\"},{\"name\":\"Server.ServeTLS\"},{\"name\":\"Server.SetKeepAlivesEnabled\"},{\"name\":\"Server.Shutdown\"},{\"name\":\"SetCookie\"},{\"name\":\"Transport.CancelRequest\"},{\"name\":\"Transport.Clone\"},{\"name\":\"Transport.CloseIdleConnections\"},{\"name\":\"Transport.NewClientConn\"},{\"name\":\"Transport.RoundTrip\"},{\"name\":\"body.Close\"},{\"name\":\"body.Read\"},{\"name\":\"bodyEOFSignal.Close\"},{\"name\":\"bodyEOFSignal.Read\"},{\"name\":\"bodyLocked.Read\"},{\"name\":\"bufioFlushWriter.Write\"},{\"name\":\"cancelTimerBody.Close\"},{\"name\":\"cancelTimerBody.Read\"},{\"name\":\"checkConnErrorWriter.Write\"},{\"name\":\"chunkWriter.Write\"},{\"name\":\"connReader.Read\"},{\"name\":\"connectMethodKey.String\"},{\"name\":\"expectContinueReader.Close\"},{\"name\":\"expectContinueReader.Read\"},{\"name\":\"extraHeader.Write\"},{\"name\":\"fileHandler.ServeHTTP\"},{\"name\":\"fileTransport.RoundTrip\"},{\"name\":\"globalOptionsHandler.ServeHTTP\"},{\"name\":\"gzipReader.Close\"},{\"name\":\"gzipReader.Read\"},{\"name\":\"http1ClientConn.Close\"},{\"name\":\"http1ClientConn.RoundTrip\"},{\"name\":\"http2ClientConn.Close\"},{\"name\":\"http2ClientConn.Ping\"},{\"name\":\"http2ClientConn.RoundTrip\"},{\"name\":\"http2ClientConn.Shutdown\"},{\"name\":\"http2ConnectionError.Error\"},{\"name\":\"http2ErrCode.String\"},{\"name\":\"http2FrameHeader.String\"},{\"name\":\"http2FrameType.String\"},{\"name\":\"http2FrameWriteRequest.String\"},{\"name\":\"http2Framer.ReadFrame\"},{\"name\":\"http2Framer.ReadFrameForHeader\"},{\"name\":\"http2Framer.ReadFrameHeader\"},{\"name\":\"http2Framer.WriteContinuation\"},{\"name\":\"http2Framer.WriteData\"},{\"name\":\"http2Framer.WriteDataPadded\"},{\"name\":\"http2Framer.WriteGoAway\"},{\"name\":\"http2Framer.WriteHeaders\"},{\"name\":\"http2Framer.WritePing\"},{\"name\":\"http2Framer.WritePriority\"},{\"name\":\"http2Framer.WritePushPromise\"},{\"name\":\"http2Framer.WriteRSTStream\"},{\"name\":\"http2Framer.WriteRawFrame\"},{\"name\":\"http2Framer.WriteSettings\"},{\"name\":\"http2Framer.WriteSettingsAck\"},{\"name\":\"http2Framer.WriteWindowUpdate\"},{\"name\":\"http2GoAwayError.Error\"},{\"name\":\"http2Server.ServeConn\"},{\"name\":\"http2Setting.String\"},{\"name\":\"http2SettingID.String\"},{\"name\":\"http2SettingsFrame.ForeachSetting\"},{\"name\":\"http2StreamError.Error\"},{\"name\":\"http2Transport.CloseIdleConnections\"},{\"name\":\"http2Transport.NewClientConn\"},{\"name\":\"http2Transport.RoundTrip\"},{\"name\":\"http2Transport.RoundTripOpt\"},{\"name\":\"http2bufferedWriter.Flush\"},{\"name\":\"http2bufferedWriter.Write\"},{\"name\":\"http2bufferedWriterTimeoutWriter.Write\"},{\"name\":\"http2chunkWriter.Write\"},{\"name\":\"http2clientConnPool.GetClientConn\"},{\"name\":\"http2connError.Error\"},{\"name\":\"http2dataBuffer.Read\"},{\"name\":\"http2duplicatePseudoHeaderError.Error\"},{\"name\":\"http2gzipReader.Close\"},{\"name\":\"http2gzipReader.Read\"},{\"name\":\"http2headerFieldNameError.Error\"},{\"name\":\"http2headerFieldValueError.Error\"},{\"name\":\"http2netHTTPClientConn.Close\"},{\"name\":\"http2netHTTPClientConn.RoundTrip\"},{\"name\":\"http2noDialClientConnPool.GetClientConn\"},{\"name\":\"http2noDialH2RoundTripper.NewClientConn\"},{\"name\":\"http2noDialH2RoundTripper.RoundTrip\"},{\"name\":\"http2pipe.Read\"},{\"name\":\"http2priorityWriteSchedulerRFC7540.CloseStream\"},{\"name\":\"http2priorityWriteSchedulerRFC7540.OpenStream\"},{\"name\":\"http2priorityWriteSchedulerRFC9218.OpenStream\"},{\"name\":\"http2pseudoHeaderError.Error\"},{\"name\":\"http2requestBody.Close\"},{\"name\":\"http2requestBody.Read\"},{\"name\":\"http2responseWriter.Flush\"},{\"name\":\"http2responseWriter.FlushError\"},{\"name\":\"http2responseWriter.Push\"},{\"name\":\"http2responseWriter.SetReadDeadline\"},{\"name\":\"http2responseWriter.SetWriteDeadline\"},{\"name\":\"http2responseWriter.Write\"},{\"name\":\"http2responseWriter.WriteHeader\"},{\"name\":\"http2responseWriter.WriteString\"},{\"name\":\"http2roundRobinWriteScheduler.OpenStream\"},{\"name\":\"http2serverConn.CloseConn\"},{\"name\":\"http2serverConn.Flush\"},{\"name\":\"http2stickyErrWriter.Write\"},{\"name\":\"http2transportResponseBody.Close\"},{\"name\":\"http2transportResponseBody.Read\"},{\"name\":\"http2unencryptedTransport.RoundTrip\"},{\"name\":\"http2writeData.String\"},{\"name\":\"initALPNRequest.ServeHTTP\"},{\"name\":\"loggingConn.Close\"},{\"name\":\"loggingConn.Read\"},{\"name\":\"loggingConn.Write\"},{\"name\":\"maxBytesReader.Close\"},{\"name\":\"maxBytesReader.Read\"},{\"name\":\"onceCloseListener.Close\"},{\"name\":\"persistConn.Read\"},{\"name\":\"persistConnWriter.ReadFrom\"},{\"name\":\"persistConnWriter.Write\"},{\"name\":\"populateResponse.Write\"},{\"name\":\"populateResponse.WriteHeader\"},{\"name\":\"readTrackingBody.Close\"},{\"name\":\"readTrackingBody.Read\"},{\"name\":\"readWriteCloserBody.CloseWrite\"},{\"name\":\"readWriteCloserBody.Read\"},{\"name\":\"redirectHandler.ServeHTTP\"},{\"name\":\"response.Flush\"},{\"name\":\"response.FlushError\"},{\"name\":\"response.Hijack\"},{\"name\":\"response.ReadFrom\"},{\"name\":\"response.Write\"},{\"name\":\"response.WriteHeader\"},{\"name\":\"response.WriteString\"},{\"name\":\"serverHandler.ServeHTTP\"},{\"name\":\"socksDialer.DialWithConn\"},{\"name\":\"socksUsernamePassword.Authenticate\"},{\"name\":\"stringWriter.WriteString\"},{\"name\":\"timeoutHandler.ServeHTTP\"},{\"name\":\"timeoutWriter.Write\"},{\"name\":\"timeoutWriter.WriteHeader\"},{\"name\":\"transportReadFromServerError.Error\"},{\"name\":\"unencryptedHTTP2Request.ServeHTTP\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.26.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Go standard library\",\"product\":\"net/http/internal/http2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"net/http/internal/http2\",\"programRoutines\":[{\"name\":\"serverConn.processSetting\"},{\"name\":\"serverConn.startFrameWrite\"},{\"name\":\"ClientConn.Close\"},{\"name\":\"ClientConn.Ping\"},{\"name\":\"ClientConn.RoundTrip\"},{\"name\":\"ClientConn.Shutdown\"},{\"name\":\"Framer.ReadFrame\"},{\"name\":\"Framer.ReadFrameForHeader\"},{\"name\":\"Framer.ReadFrameHeader\"},{\"name\":\"Framer.WriteContinuation\"},{\"name\":\"Framer.WriteData\"},{\"name\":\"Framer.WriteDataPadded\"},{\"name\":\"Framer.WriteGoAway\"},{\"name\":\"Framer.WriteHeaders\"},{\"name\":\"Framer.WritePing\"},{\"name\":\"Framer.WritePriority\"},{\"name\":\"Framer.WritePriorityUpdate\"},{\"name\":\"Framer.WritePushPromise\"},{\"name\":\"Framer.WriteRSTStream\"},{\"name\":\"Framer.WriteRawFrame\"},{\"name\":\"Framer.WriteSettings\"},{\"name\":\"Framer.WriteSettingsAck\"},{\"name\":\"Framer.WriteWindowUpdate\"},{\"name\":\"NetHTTPClientConn.Close\"},{\"name\":\"NetHTTPClientConn.Ping\"},{\"name\":\"NetHTTPClientConn.RoundTrip\"},{\"name\":\"ReadFrameHeader\"},{\"name\":\"Server.GracefulShutdown\"},{\"name\":\"Server.ServeConn\"},{\"name\":\"SettingsFrame.ForeachSetting\"},{\"name\":\"Transport.AddConn\"},{\"name\":\"Transport.CloseIdleConnections\"},{\"name\":\"Transport.NewClientConn\"},{\"name\":\"Transport.RoundTrip\"},{\"name\":\"Transport.RoundTripOpt\"},{\"name\":\"bufferedWriter.Flush\"},{\"name\":\"bufferedWriter.Write\"},{\"name\":\"bufferedWriterTimeoutWriter.Write\"},{\"name\":\"chunkWriter.Write\"},{\"name\":\"clientConnPool.GetClientConn\"},{\"name\":\"gzipReader.Close\"},{\"name\":\"gzipReader.Read\"},{\"name\":\"noDialClientConnPool.GetClientConn\"},{\"name\":\"requestBody.Close\"},{\"name\":\"responseWriter.Flush\"},{\"name\":\"responseWriter.FlushError\"},{\"name\":\"responseWriter.Push\"},{\"name\":\"responseWriter.Write\"},{\"name\":\"responseWriter.WriteHeader\"},{\"name\":\"responseWriter.WriteString\"},{\"name\":\"serve400Handler.ServeHTTP\"},{\"name\":\"serverConn.Flush\"},{\"name\":\"stickyErrWriter.Write\"},{\"name\":\"transportResponseBody.Close\"},{\"name\":\"transportResponseBody.Read\"}],\"versions\":[{\"version\":\"1.27.0-0\",\"lessThan\":\"1.27.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"golang.org/x/net\",\"product\":\"golang.org/x/net/http2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"golang.org/x/net/http2\",\"programRoutines\":[{\"name\":\"serverConn.processSetting\"},{\"name\":\"serverConn.startFrameWrite\"},{\"name\":\"ClientConn.Close\"},{\"name\":\"ClientConn.Ping\"},{\"name\":\"ClientConn.RoundTrip\"},{\"name\":\"ClientConn.Shutdown\"},{\"name\":\"ConfigureServer\"},{\"name\":\"ConfigureTransport\"},{\"name\":\"ConfigureTransports\"},{\"name\":\"ConnectionError.Error\"},{\"name\":\"ErrCode.String\"},{\"name\":\"FrameHeader.String\"},{\"name\":\"FrameType.String\"},{\"name\":\"FrameWriteRequest.String\"},{\"name\":\"Framer.ReadFrame\"},{\"name\":\"Framer.ReadFrameForHeader\"},{\"name\":\"Framer.ReadFrameHeader\"},{\"name\":\"Framer.WriteContinuation\"},{\"name\":\"Framer.WriteData\"},{\"name\":\"Framer.WriteDataPadded\"},{\"name\":\"Framer.WriteGoAway\"},{\"name\":\"Framer.WriteHeaders\"},{\"name\":\"Framer.WritePing\"},{\"name\":\"Framer.WritePriority\"},{\"name\":\"Framer.WritePriorityUpdate\"},{\"name\":\"Framer.WritePushPromise\"},{\"name\":\"Framer.WriteRSTStream\"},{\"name\":\"Framer.WriteRawFrame\"},{\"name\":\"Framer.WriteSettings\"},{\"name\":\"Framer.WriteSettingsAck\"},{\"name\":\"Framer.WriteWindowUpdate\"},{\"name\":\"GoAwayError.Error\"},{\"name\":\"ReadFrameHeader\"},{\"name\":\"Server.ServeConn\"},{\"name\":\"Setting.String\"},{\"name\":\"SettingID.String\"},{\"name\":\"SettingsFrame.ForeachSetting\"},{\"name\":\"StreamError.Error\"},{\"name\":\"Transport.CloseIdleConnections\"},{\"name\":\"Transport.NewClientConn\"},{\"name\":\"Transport.RoundTrip\"},{\"name\":\"Transport.RoundTripOpt\"},{\"name\":\"bufferedWriter.Flush\"},{\"name\":\"bufferedWriter.Write\"},{\"name\":\"bufferedWriterTimeoutWriter.Write\"},{\"name\":\"chunkWriter.Write\"},{\"name\":\"clientConnPool.GetClientConn\"},{\"name\":\"connError.Error\"},{\"name\":\"dataBuffer.Read\"},{\"name\":\"duplicatePseudoHeaderError.Error\"},{\"name\":\"gzipReader.Close\"},{\"name\":\"gzipReader.Read\"},{\"name\":\"headerFieldNameError.Error\"},{\"name\":\"headerFieldValueError.Error\"},{\"name\":\"netHTTPClientConn.Close\"},{\"name\":\"netHTTPClientConn.RoundTrip\"},{\"name\":\"noDialClientConnPool.GetClientConn\"},{\"name\":\"noDialH2RoundTripper.NewClientConn\"},{\"name\":\"noDialH2RoundTripper.RoundTrip\"},{\"name\":\"pipe.Read\"},{\"name\":\"priorityWriteSchedulerRFC7540.CloseStream\"},{\"name\":\"priorityWriteSchedulerRFC7540.OpenStream\"},{\"name\":\"priorityWriteSchedulerRFC9218.OpenStream\"},{\"name\":\"pseudoHeaderError.Error\"},{\"name\":\"requestBody.Close\"},{\"name\":\"requestBody.Read\"},{\"name\":\"responseWriter.Flush\"},{\"name\":\"responseWriter.FlushError\"},{\"name\":\"responseWriter.Push\"},{\"name\":\"responseWriter.SetReadDeadline\"},{\"name\":\"responseWriter.SetWriteDeadline\"},{\"name\":\"responseWriter.Write\"},{\"name\":\"responseWriter.WriteHeader\"},{\"name\":\"responseWriter.WriteString\"},{\"name\":\"roundRobinWriteScheduler.OpenStream\"},{\"name\":\"serverConn.CloseConn\"},{\"name\":\"serverConn.Flush\"},{\"name\":\"stickyErrWriter.Write\"},{\"name\":\"transportResponseBody.Close\"},{\"name\":\"transportResponseBody.Read\"},{\"name\":\"unencryptedTransport.RoundTrip\"},{\"name\":\"writeData.String\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.60.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-10-15T15:46:16.190858Z\",\"id\":\"CVE-2026-97032\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"references\":[{\"url\":\"https://go.dev/cl/847188\",\"source\":\"security@golang.org\"},{\"url\":\"https://go.dev/cl/847313\",\"source\":\"security@golang.org\"},{\"url\":\"https://go.dev/issue/81867\",\"source\":\"security@golang.org\"},{\"url\":\"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI\",\"source\":\"security@golang.org\"},{\"url\":\"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs\",\"source\":\"security@golang.org\"},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-6617\",\"source\":\"security@golang.org\"}]}}", "redhat_vex": {"aggregate_severity": "Moderate", "current_release_date": "2026-10-15T18:35:01+00:00", "cve": "CVE-2026-97032", "id": "CVE-2026-97032", "initial_release_date": "2026-10-08T22:54:00.230000+00:00", "product_status:known_affected": "342", "source": "Red Hat CSAF VEX", "status": "final", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97032.json", "version": "3"}, "vulnrichment": {"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-10-08T22:54:00.230Z\"}, \"title\": \"HTTP/2 server crash due to HPACK encoder race in net/http\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.\"}], \"affected\": [{\"vendor\": \"Go standard library\", \"product\": \"net/http\", \"collectionURL\": \"https://pkg.go.dev\", \"packageName\": \"net/http\", \"versions\": [{\"version\": \"0\", \"lessThan\": \"1.26.9\", \"status\": \"affected\", \"versionType\": \"semver\"}], \"programRoutines\": [{\"name\": \"http2serverConn.processSetting\"}, {\"name\": \"http2serverConn.startFrameWrite\"}, {\"name\": \"CanonicalHeaderKey\"}, {\"name\": \"Client.CloseIdleConnections\"}, {\"name\": \"Client.Do\"}, {\"name\": \"Client.Get\"}, {\"name\": \"Client.Head\"}, {\"name\": \"Client.Post\"}, {\"name\": \"Client.PostForm\"}, {\"name\": \"ClientConn.Close\"}, {\"name\": \"ClientConn.RoundTrip\"}, {\"name\": \"Cookie.String\"}, {\"name\": \"Cookie.Valid\"}, {\"name\": \"CrossOriginProtection.AddInsecureBypassPattern\"}, {\"name\": \"CrossOriginProtection.AddTrustedOrigin\"}, {\"name\": \"CrossOriginProtection.Check\"}, {\"name\": \"Dir.Open\"}, {\"name\": \"Error\"}, {\"name\": \"Get\"}, {\"name\": \"Handle\"}, {\"name\": \"HandleFunc\"}, {\"name\": \"HandlerFunc.ServeHTTP\"}, {\"name\": \"Head\"}, {\"name\": \"Header.Add\"}, {\"name\": \"Header.Del\"}, {\"name\": \"Header.Get\"}, {\"name\": \"Header.Set\"}, {\"name\": \"Header.Values\"}, {\"name\": \"Header.Write\"}, {\"name\": \"Header.WriteSubset\"}, {\"name\": \"ListenAndServe\"}, {\"name\": \"ListenAndServeTLS\"}, {\"name\": \"NewRequest\"}, {\"name\": \"NewRequestWithContext\"}, {\"name\": \"NotFound\"}, {\"name\": \"ParseCookie\"}, {\"name\": \"ParseSetCookie\"}, {\"name\": \"ParseTime\"}, {\"name\": \"Post\"}, {\"name\": \"PostForm\"}, {\"name\": \"ProxyFromEnvironment\"}, {\"name\": \"ReadRequest\"}, {\"name\": \"ReadResponse\"}, {\"name\": \"Redirect\"}, {\"name\": \"Request.AddCookie\"}, {\"name\": \"Request.BasicAuth\"}, {\"name\": \"Request.Cookie\"}, {\"name\": \"Request.Cookies\"}, {\"name\": \"Request.CookiesNamed\"}, {\"name\": \"Request.FormFile\"}, {\"name\": \"Request.FormValue\"}, {\"name\": \"Request.MultipartReader\"}, {\"name\": \"Request.ParseForm\"}, {\"name\": \"Request.ParseMultipartForm\"}, {\"name\": \"Request.PostFormValue\"}, {\"name\": \"Request.Referer\"}, {\"name\": \"Request.SetBasicAuth\"}, {\"name\": \"Request.UserAgent\"}, {\"name\": \"Request.Write\"}, {\"name\": \"Request.WriteProxy\"}, {\"name\": \"Response.Cookies\"}, {\"name\": \"Response.Location\"}, {\"name\": \"Response.Write\"}, {\"name\": \"ResponseController.EnableFullDuplex\"}, {\"name\": \"ResponseController.Flush\"}, {\"name\": \"ResponseController.Hijack\"}, {\"name\": \"ResponseController.SetReadDeadline\"}, {\"name\": \"ResponseController.SetWriteDeadline\"}, {\"name\": \"Serve\"}, {\"name\": \"ServeContent\"}, {\"name\": \"ServeFile\"}, {\"name\": \"ServeFileFS\"}, {\"name\": \"ServeMux.Handle\"}, {\"name\": \"ServeMux.HandleFunc\"}, {\"name\": \"ServeMux.ServeHTTP\"}, {\"name\": \"ServeTLS\"}, {\"name\": \"Server.Close\"}, {\"name\": \"Server.ListenAndServe\"}, {\"name\": \"Server.ListenAndServeTLS\"}, {\"name\": \"Server.Serve\"}, {\"name\": \"Server.ServeTLS\"}, {\"name\": \"Server.SetKeepAlivesEnabled\"}, {\"name\": \"Server.Shutdown\"}, {\"name\": \"SetCookie\"}, {\"name\": \"Transport.CancelRequest\"}, {\"name\": \"Transport.Clone\"}, {\"name\": \"Transport.CloseIdleConnections\"}, {\"name\": \"Transport.NewClientConn\"}, {\"name\": \"Transport.RoundTrip\"}, {\"name\": \"body.Close\"}, {\"name\": \"body.Read\"}, {\"name\": \"bodyEOFSignal.Close\"}, {\"name\": \"bodyEOFSignal.Read\"}, {\"name\": \"bodyLocked.Read\"}, {\"name\": \"bufioFlushWriter.Write\"}, {\"name\": \"cancelTimerBody.Close\"}, {\"name\": \"cancelTimerBody.Read\"}, {\"name\": \"checkConnErrorWriter.Write\"}, {\"name\": \"chunkWriter.Write\"}, {\"name\": \"connReader.Read\"}, {\"name\": \"connectMethodKey.String\"}, {\"name\": \"expectContinueReader.Close\"}, {\"name\": \"expectContinueReader.Read\"}, {\"name\": \"extraHeader.Write\"}, {\"name\": \"fileHandler.ServeHTTP\"}, {\"name\": \"fileTransport.RoundTrip\"}, {\"name\": \"globalOptionsHandler.ServeHTTP\"}, {\"name\": \"gzipReader.Close\"}, {\"name\": \"gzipReader.Read\"}, {\"name\": \"http1ClientConn.Close\"}, {\"name\": \"http1ClientConn.RoundTrip\"}, {\"name\": \"http2ClientConn.Close\"}, {\"name\": \"http2ClientConn.Ping\"}, {\"name\": \"http2ClientConn.RoundTrip\"}, {\"name\": \"http2ClientConn.Shutdown\"}, {\"name\": \"http2ConnectionError.Error\"}, {\"name\": \"http2ErrCode.String\"}, {\"name\": \"http2FrameHeader.String\"}, {\"name\": \"http2FrameType.String\"}, {\"name\": \"http2FrameWriteRequest.String\"}, {\"name\": \"http2Framer.ReadFrame\"}, {\"name\": \"http2Framer.ReadFrameForHeader\"}, {\"name\": \"http2Framer.ReadFrameHeader\"}, {\"name\": \"http2Framer.WriteContinuation\"}, {\"name\": \"http2Framer.WriteData\"}, {\"name\": \"http2Framer.WriteDataPadded\"}, {\"name\": \"http2Framer.WriteGoAway\"}, {\"name\": \"http2Framer.WriteHeaders\"}, {\"name\": \"http2Framer.WritePing\"}, {\"name\": \"http2Framer.WritePriority\"}, {\"name\": \"http2Framer.WritePushPromise\"}, {\"name\": \"http2Framer.WriteRSTStream\"}, {\"name\": \"http2Framer.WriteRawFrame\"}, {\"name\": \"http2Framer.WriteSettings\"}, {\"name\": \"http2Framer.WriteSettingsAck\"}, {\"name\": \"http2Framer.WriteWindowUpdate\"}, {\"name\": \"http2GoAwayError.Error\"}, {\"name\": \"http2Server.ServeConn\"}, {\"name\": \"http2Setting.String\"}, {\"name\": \"http2SettingID.String\"}, {\"name\": \"http2SettingsFrame.ForeachSetting\"}, {\"name\": \"http2StreamError.Error\"}, {\"name\": \"http2Transport.CloseIdleConnections\"}, {\"name\": \"http2Transport.NewClientConn\"}, {\"name\": \"http2Transport.RoundTrip\"}, {\"name\": \"http2Transport.RoundTripOpt\"}, {\"name\": \"http2bufferedWriter.Flush\"}, {\"name\": \"http2bufferedWriter.Write\"}, {\"name\": \"http2bufferedWriterTimeoutWriter.Write\"}, {\"name\": \"http2chunkWriter.Write\"}, {\"name\": \"http2clientConnPool.GetClientConn\"}, {\"name\": \"http2connError.Error\"}, {\"name\": \"http2dataBuffer.Read\"}, {\"name\": \"http2duplicatePseudoHeaderError.Error\"}, {\"name\": \"http2gzipReader.Close\"}, {\"name\": \"http2gzipReader.Read\"}, {\"name\": \"http2headerFieldNameError.Error\"}, {\"name\": \"http2headerFieldValueError.Error\"}, {\"name\": \"http2netHTTPClientConn.Close\"}, {\"name\": \"http2netHTTPClientConn.RoundTrip\"}, {\"name\": \"http2noDialClientConnPool.GetClientConn\"}, {\"name\": \"http2noDialH2RoundTripper.NewClientConn\"}, {\"name\": \"http2noDialH2RoundTripper.RoundTrip\"}, {\"name\": \"http2pipe.Read\"}, {\"name\": \"http2priorityWriteSchedulerRFC7540.CloseStream\"}, {\"name\": \"http2priorityWriteSchedulerRFC7540.OpenStream\"}, {\"name\": \"http2priorityWriteSchedulerRFC9218.OpenStream\"}, {\"name\": \"http2pseudoHeaderError.Error\"}, {\"name\": \"http2requestBody.Close\"}, {\"name\": \"http2requestBody.Read\"}, {\"name\": \"http2responseWriter.Flush\"}, {\"name\": \"http2responseWriter.FlushError\"}, {\"name\": \"http2responseWriter.Push\"}, {\"name\": \"http2responseWriter.SetReadDeadline\"}, {\"name\": \"http2responseWriter.SetWriteDeadline\"}, {\"name\": \"http2responseWriter.Write\"}, {\"name\": \"http2responseWriter.WriteHeader\"}, {\"name\": \"http2responseWriter.WriteString\"}, {\"name\": \"http2roundRobinWriteScheduler.OpenStream\"}, {\"name\": \"http2serverConn.CloseConn\"}, {\"name\": \"http2serverConn.Flush\"}, {\"name\": \"http2stickyErrWriter.Write\"}, {\"name\": \"http2transportResponseBody.Close\"}, {\"name\": \"http2transportResponseBody.Read\"}, {\"name\": \"http2unencryptedTransport.RoundTrip\"}, {\"name\": \"http2writeData.String\"}, {\"name\": \"initALPNRequest.ServeHTTP\"}, {\"name\": \"loggingConn.Close\"}, {\"name\": \"loggingConn.Read\"}, {\"name\": \"loggingConn.Write\"}, {\"name\": \"maxBytesReader.Close\"}, {\"name\": \"maxBytesReader.Read\"}, {\"name\": \"onceCloseListener.Close\"}, {\"name\": \"persistConn.Read\"}, {\"name\": \"persistConnWriter.ReadFrom\"}, {\"name\": \"persistConnWriter.Write\"}, {\"name\": \"populateResponse.Write\"}, {\"name\": \"populateResponse.WriteHeader\"}, {\"name\": \"readTrackingBody.Close\"}, {\"name\": \"readTrackingBody.Read\"}, {\"name\": \"readWriteCloserBody.CloseWrite\"}, {\"name\": \"readWriteCloserBody.Read\"}, {\"name\": \"redirectHandler.ServeHTTP\"}, {\"name\": \"response.Flush\"}, {\"name\": \"response.FlushError\"}, {\"name\": \"response.Hijack\"}, {\"name\": \"response.ReadFrom\"}, {\"name\": \"response.Write\"}, {\"name\": \"response.WriteHeader\"}, {\"name\": \"response.WriteString\"}, {\"name\": \"serverHandler.ServeHTTP\"}, {\"name\": \"socksDialer.DialWithConn\"}, {\"name\": \"socksUsernamePassword.Authenticate\"}, {\"name\": \"stringWriter.WriteString\"}, {\"name\": \"timeoutHandler.ServeHTTP\"}, {\"name\": \"timeoutWriter.Write\"}, {\"name\": \"timeoutWriter.WriteHeader\"}, {\"name\": \"transportReadFromServerError.Error\"}, {\"name\": \"unencryptedHTTP2Request.ServeHTTP\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Go standard library\", \"product\": \"net/http/internal/http2\", \"collectionURL\": \"https://pkg.go.dev\", \"packageName\": \"net/http/internal/http2\", \"versions\": [{\"version\": \"1.27.0-0\", \"lessThan\": \"1.27.2\", \"status\": \"affected\", \"versionType\": \"semver\"}], \"programRoutines\": [{\"name\": \"serverConn.processSetting\"}, {\"name\": \"serverConn.startFrameWrite\"}, {\"name\": \"ClientConn.Close\"}, {\"name\": \"ClientConn.Ping\"}, {\"name\": \"ClientConn.RoundTrip\"}, {\"name\": \"ClientConn.Shutdown\"}, {\"name\": \"Framer.ReadFrame\"}, {\"name\": \"Framer.ReadFrameForHeader\"}, {\"name\": \"Framer.ReadFrameHeader\"}, {\"name\": \"Framer.WriteContinuation\"}, {\"name\": \"Framer.WriteData\"}, {\"name\": \"Framer.WriteDataPadded\"}, {\"name\": \"Framer.WriteGoAway\"}, {\"name\": \"Framer.WriteHeaders\"}, {\"name\": \"Framer.WritePing\"}, {\"name\": \"Framer.WritePriority\"}, {\"name\": \"Framer.WritePriorityUpdate\"}, {\"name\": \"Framer.WritePushPromise\"}, {\"name\": \"Framer.WriteRSTStream\"}, {\"name\": \"Framer.WriteRawFrame\"}, {\"name\": \"Framer.WriteSettings\"}, {\"name\": \"Framer.WriteSettingsAck\"}, {\"name\": \"Framer.WriteWindowUpdate\"}, {\"name\": \"NetHTTPClientConn.Close\"}, {\"name\": \"NetHTTPClientConn.Ping\"}, {\"name\": \"NetHTTPClientConn.RoundTrip\"}, {\"name\": \"ReadFrameHeader\"}, {\"name\": \"Server.GracefulShutdown\"}, {\"name\": \"Server.ServeConn\"}, {\"name\": \"SettingsFrame.ForeachSetting\"}, {\"name\": \"Transport.AddConn\"}, {\"name\": \"Transport.CloseIdleConnections\"}, {\"name\": \"Transport.NewClientConn\"}, {\"name\": \"Transport.RoundTrip\"}, {\"name\": \"Transport.RoundTripOpt\"}, {\"name\": \"bufferedWriter.Flush\"}, {\"name\": \"bufferedWriter.Write\"}, {\"name\": \"bufferedWriterTimeoutWriter.Write\"}, {\"name\": \"chunkWriter.Write\"}, {\"name\": \"clientConnPool.GetClientConn\"}, {\"name\": \"gzipReader.Close\"}, {\"name\": \"gzipReader.Read\"}, {\"name\": \"noDialClientConnPool.GetClientConn\"}, {\"name\": \"requestBody.Close\"}, {\"name\": \"responseWriter.Flush\"}, {\"name\": \"responseWriter.FlushError\"}, {\"name\": \"responseWriter.Push\"}, {\"name\": \"responseWriter.Write\"}, {\"name\": \"responseWriter.WriteHeader\"}, {\"name\": \"responseWriter.WriteString\"}, {\"name\": \"serve400Handler.ServeHTTP\"}, {\"name\": \"serverConn.Flush\"}, {\"name\": \"stickyErrWriter.Write\"}, {\"name\": \"transportResponseBody.Close\"}, {\"name\": \"transportResponseBody.Read\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"golang.org/x/net\", \"product\": \"golang.org/x/net/http2\", \"collectionURL\": \"https://pkg.go.dev\", \"packageName\": \"golang.org/x/net/http2\", \"versions\": [{\"version\": \"0\", \"lessThan\": \"0.60.0\", \"status\": \"affected\", \"versionType\": \"semver\"}], \"programRoutines\": [{\"name\": \"serverConn.processSetting\"}, {\"name\": \"serverConn.startFrameWrite\"}, {\"name\": \"ClientConn.Close\"}, {\"name\": \"ClientConn.Ping\"}, {\"name\": \"ClientConn.RoundTrip\"}, {\"name\": \"ClientConn.Shutdown\"}, {\"name\": \"ConfigureServer\"}, {\"name\": \"ConfigureTransport\"}, {\"name\": \"ConfigureTransports\"}, {\"name\": \"ConnectionError.Error\"}, {\"name\": \"ErrCode.String\"}, {\"name\": \"FrameHeader.String\"}, {\"name\": \"FrameType.String\"}, {\"name\": \"FrameWriteRequest.String\"}, {\"name\": \"Framer.ReadFrame\"}, {\"name\": \"Framer.ReadFrameForHeader\"}, {\"name\": \"Framer.ReadFrameHeader\"}, {\"name\": \"Framer.WriteContinuation\"}, {\"name\": \"Framer.WriteData\"}, {\"name\": \"Framer.WriteDataPadded\"}, {\"name\": \"Framer.WriteGoAway\"}, {\"name\": \"Framer.WriteHeaders\"}, {\"name\": \"Framer.WritePing\"}, {\"name\": \"Framer.WritePriority\"}, {\"name\": \"Framer.WritePriorityUpdate\"}, {\"name\": \"Framer.WritePushPromise\"}, {\"name\": \"Framer.WriteRSTStream\"}, {\"name\": \"Framer.WriteRawFrame\"}, {\"name\": \"Framer.WriteSettings\"}, {\"name\": \"Framer.WriteSettingsAck\"}, {\"name\": \"Framer.WriteWindowUpdate\"}, {\"name\": \"GoAwayError.Error\"}, {\"name\": \"ReadFrameHeader\"}, {\"name\": \"Server.ServeConn\"}, {\"name\": \"Setting.String\"}, {\"name\": \"SettingID.String\"}, {\"name\": \"SettingsFrame.ForeachSetting\"}, {\"name\": \"StreamError.Error\"}, {\"name\": \"Transport.CloseIdleConnections\"}, {\"name\": \"Transport.NewClientConn\"}, {\"name\": \"Transport.RoundTrip\"}, {\"name\": \"Transport.RoundTripOpt\"}, {\"name\": \"bufferedWriter.Flush\"}, {\"name\": \"bufferedWriter.Write\"}, {\"name\": \"bufferedWriterTimeoutWriter.Write\"}, {\"name\": \"chunkWriter.Write\"}, {\"name\": \"clientConnPool.GetClientConn\"}, {\"name\": \"connError.Error\"}, {\"name\": \"dataBuffer.Read\"}, {\"name\": \"duplicatePseudoHeaderError.Error\"}, {\"name\": \"gzipReader.Close\"}, {\"name\": \"gzipReader.Read\"}, {\"name\": \"headerFieldNameError.Error\"}, {\"name\": \"headerFieldValueError.Error\"}, {\"name\": \"netHTTPClientConn.Close\"}, {\"name\": \"netHTTPClientConn.RoundTrip\"}, {\"name\": \"noDialClientConnPool.GetClientConn\"}, {\"name\": \"noDialH2RoundTripper.NewClientConn\"}, {\"name\": \"noDialH2RoundTripper.RoundTrip\"}, {\"name\": \"pipe.Read\"}, {\"name\": \"priorityWriteSchedulerRFC7540.CloseStream\"}, {\"name\": \"priorityWriteSchedulerRFC7540.OpenStream\"}, {\"name\": \"priorityWriteSchedulerRFC9218.OpenStream\"}, {\"name\": \"pseudoHeaderError.Error\"}, {\"name\": \"requestBody.Close\"}, {\"name\": \"requestBody.Read\"}, {\"name\": \"responseWriter.Flush\"}, {\"name\": \"responseWriter.FlushError\"}, {\"name\": \"responseWriter.Push\"}, {\"name\": \"responseWriter.SetReadDeadline\"}, {\"name\": \"responseWriter.SetWriteDeadline\"}, {\"name\": \"responseWriter.Write\"}, {\"name\": \"responseWriter.WriteHeader\"}, {\"name\": \"responseWriter.WriteString\"}, {\"name\": \"roundRobinWriteScheduler.OpenStream\"}, {\"name\": \"serverConn.CloseConn\"}, {\"name\": \"serverConn.Flush\"}, {\"name\": \"stickyErrWriter.Write\"}, {\"name\": \"transportResponseBody.Close\"}, {\"name\": \"transportResponseBody.Read\"}, {\"name\": \"unencryptedTransport.RoundTrip\"}, {\"name\": \"writeData.String\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\"}]}], \"references\": [{\"url\": \"https://go.dev/cl/847188\"}, {\"url\": \"https://go.dev/cl/847313\"}, {\"url\": \"https://go.dev/issue/81867\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-6617\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"RyotaK (https://ryotak.net) of GMO Flatt Security Inc.\"}]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-97032\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T15:46:16.190858Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T15:46:08.235Z\"}}]}", "cveMetadata": "{\"cveId\": \"CVE-2026-97032\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Go\", \"dateReserved\": \"2026-09-23T23:03:58.333Z\", \"datePublished\": \"2026-10-08T22:54:00.230Z\", \"dateUpdated\": \"2026-10-15T15:46:39.417Z\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}