CVE-2026-97032

HighCVSS 7.5

Published: 08/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

HTTP/2 servers can crash due to concurrent modification of the HPACK encoder without synchronization. Two goroutines modify the encoder: one encodes a HEADERS frame, the other changes table size when handling a SETTINGS frame with SETTINGS_HEADER_TABLE_SIZE. A malicious client can repeatedly send requests while changing the header table size to crash the server.

Risk Assessment

A remote attacker can crash the server, causing denial of service for all users.

Recommendation

Apply patches from the HTTP/2 server vendor. If possible, restrict clients' ability to change header table size.

Other vulnerabilities in HTTP/2 server

CVE-2026-56853High
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Original NVD description (English source)

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS