Executive brief
Go's HTTP/2 implementation fails to apply the configured read timeout when establishing unencrypted HTTP/2 connections. An attacker can exploit this by sending partial HTTP/2 handshake data slowly, bypassing the timeout protection and causing the server to hang indefinitely or consume resources. This affects Go-based web services and APIs that support HTTP/2 without TLS.
Technical details
When a Go server is configured to support plaintext HTTP/2, it reads the HTTP/2 client preface (24 bytes: "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n") from new connections to detect the protocol. The vulnerability is that the ReadHeaderTimeout setting is not enforced during this initial read operation. An attacker can send bytes slowly or incompletely to the preface detector, causing the server to wait indefinitely without triggering the timeout. The attack requires a network-reachable HTTP/2 server with plaintext (h2c) enabled and no other timeouts configured at a lower level. This leads to connection exhaustion and denial of service.
Affected products
- Go Go <UNKNOWN>
Timeline
- 2026-08-13: disclosed