CVE-2022-27664 In net/http in Go before 1.18.6 and 1.19.x before 1.19.1 attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Denial of Service Vulnerabilities in Go's net/http Module Two denial of service vulnerabilities have been identified in Go's net/http module. CVE-2022-27664, published on September 6, 2022, allows attackers to cause a denial of service due to HTTP/2 connection issues during closing. CVE-2024-24791, published on July 2, 2024, arises from improper handling of the 100-continue response. 3 sources 52

Extracted Entities

Attack Types (1)

CVEs (1)