CVE-2026-56853
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
Risk Assessment
The lack of timeout enforcement may allow an attacker to keep connections open, potentially leading to resource exhaustion on the server.
Recommendation
It is recommended to update the software to a version where this behavior is fixed, and to configure appropriate timeouts for HTTP/2 connections.
Original NVD description (English source)
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.