CVE-2026-78660
EPSS 0.4%Vendor patching but bulk advisory format, no PoC, no KEV, negligible EPSS; recycled security bulletin chatter.
What: HTTP/2 to HTTP/1 response smuggling in reverse proxy implementations via malformed framing headers (CVSS n/a, EPSS 0.21%).
Why it matters: Not KEV-listed; EPSS extremely low (0.21st percentile). Chatter is vendor security advisories for Google Apigee components patching the flaw, but no public PoC, no confirmed in-the-wild exploitation, and no urgent defender activity beyond routine patching cycles.
Where it's seen: Six Bluesky posts listing CVE-2026-78660 alongside dozens of other CVEs in boilerplate Apigee security fix announcements across multiple modules (watcher, udca, redis, prometheus-adapter, operators, cassandra-client, istiod). No technical discussion, PoC, or exploitation signals.
RISK: MODERATE — HTTP/2 framing bug affecting reverse proxy; low EPSS and no active exploitation reduce immediate threat surface.
Description
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.