CVE-2026-78659
EPSS 0.6%Vendor patching real but chatter is recycled advisory noise; no PoC or active exploitation signal.
What: HTTP/2 server memory exhaustion via malicious "Trailer" headers declaring large field counts, bypassing MaxHeaderValueCount and MaxHeaderBytes limits. Affects Go's net/http and downstream HTTP/2 implementations.
Why it matters: CVE-2026-78659 is bundled across multiple Google Apigee component security advisories (watcher, udca, redis, prometheus-adapter, operators, cassandra-client, asm-istiod). Vendor patching urgently across platform stack signals real remediation activity. EPSS is minimal (0.46th percentile), KEV not listed, no public PoC or in-the-wild exploitation reported yet.
Where it's seen: Repeated boilerplate security advisory posts on Bluesky listing this CVE alongside dozens of others in Apigee module patches. No dedicated researcher analysis, PoC, or defender triage chatter visible; CVE appears as line item in bulk vendor releases.
RISK: MODERATE — HTTP/2-specific DoS requires active mitigation; low EPSS and KEV absence temper urgency.
Description
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.