CVE-2026-97032
EPSS 0.5%Vendor patching confirms real vuln; no KEV, PoC, or defender triage chatter. Routine advisory bundle.
What: HTTP/2 server crash via concurrent HPACK encoder modification when clients repeatedly send requests with SETTINGS_HEADER_TABLE_SIZE changes (Go net/http and derivatives; CVSS unavailable, EPSS 0.0042).
Why it matters: Denial-of-service vector affecting HTTP/2 implementations. Google patched Apigee hybrid v1.15.9 on October 21, 2026. No KEV listing, no public PoC observed. Vendor actively patching across multiple Apigee components suggests real but low-severity impact.
Where it's seen: Apigee security advisories bundling CVE-2026-97032 alongside other fixes in hybrid, runtime, watcher, redis, prometheus, rbac-proxy, fluent-bit, and istiod releases. No standalone researcher PoC or high-profile chatter; appears as part of routine vendor patch coordination.
RISK: MODERATE — Patched vendor DoS via HTTP/2 race condition; EPSS minimal; no active exploitation signals.
Description
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.