Is CVE-2026-78663 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78663 being exploited in the wild.

How severe is CVE-2026-78663?

Critical severity, with a CVSS score of 9.1, published 8 October 2026.

Is there a fix for CVE-2026-78663?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78663 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78663?

Check whether you run Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78663: Go net/http double flow control refund on HTTP/2 server streams

CVE-2026-78663 · Severity: critical · CVSS 9.1 · Published 2026-10-08

Go's net/http library, used to build web services and APIs, has a flow control bug in its HTTP/2 server implementation. An attacker can trigger a double refund of flow control credits by closing streams in a specific way, allowing them to send more data than the protocol permits, potentially causing denial of service or resource exhaustion.

Technologies: Google Go. Vendors: Google.

Quick answers

Is CVE-2026-78663 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78663 being exploited in the wild.
How severe is CVE-2026-78663?: Critical severity, with a CVSS score of 9.1, published 8 October 2026.
Which products and versions are affected?: Google Go <UNKNOWN>.
Is there a fix for CVE-2026-78663?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78663 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78663?: Check whether you run Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a logic error in HTTP/2 flow control handling on the server side where stream closure triggers a double refund of flow control window credits. An attacker with network access can exploit this by crafting a sequence of stream closure events, exhausting the server's flow control window and enabling unbounded data transmission. The attack requires no authentication and is remotely exploitable on any Go HTTP/2 server.

Affected products

Google Go <UNKNOWN>

Identifiers

CVE-2026-78663
GO-2026-6612

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.