CVE-2026-78663
EPSS 0.6%Vendor advisory mentions only; no PoC, KEV listing, or defender urgency visible; bulk CVE noise dominates signal.
What: Go's built-in HTTP/2 server allows a malicious client to bypass connection-level flow control limits by exploiting double refunds when streams are reset, enabling excess data transmission beyond MaxReceiveBufferPerConnection.
Why it matters: CVSS unavailable and EPSS extremely low (0.46%). Not KEV-listed. No public PoC or in-the-wild exploitation reported. Social chatter is primarily Google Apigee security advisory boilerplate bundling CVE-2026-78663 with dozens of other fixes across multiple components—no focused defender triage or urgent patching signals.
Where it's seen: Repetitive Apigee product release notes listing bulk CVE IDs without technical detail or exploitation context. One brief stdlib reference but no follow-up discussion, PoC links, or active remediation threads.
RISK: LOW — HTTP/2 flaw requires malicious client; practical impact limited by concurrent stream and stream-level limits.
Description
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.