bhautik 🎶🦒@bhautiktweets
@golang HPACK encoder race condition (CVE-2026-97032) - fixed in 1.27.2 🫰🏻
00000328
147 followersView on X
CVE-2026-97032
LOWCVSS 7.5 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-362
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day