CVE-2026-56853
Vulnerability Summary
Timeline
Description
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.57%• Percentile: 46%
Techniques & Countermeasures
- CWE-770•Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected Systems
- chainguard•aactl
< 0.4.12-r68
- chainguard•actions-runner-controller-fips
< 0.14.2-r7
- chainguard•addon-resizer
< 1.8.24-r1
- chainguard•age
< 0
- chainguard•age-fips
< 0
- chainguard•agentbeat-fips
< 9.2.7-r21
- chainguard•amass
< 5.1.1-r12
- chainguard•amazon-cloudwatch-agent
< 1.300072.0-r1
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 0
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader
< 0
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 0
- chainguard•amazon-cloudwatch-agent-config-translator
< 0
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 0
- chainguard•amazon-cloudwatch-agent-fips
< 1.300072.0-r1
- chainguard•amazon-cloudwatch-agent-operator
< 3.7.0-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 0
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-ecs-agent-fips
< 0 | < 1.106.0-r3
- chainguard•amazon-ecs-cni-plugins
< 0
- chainguard•amazon-ecs-cni-plugins-fips
< 0
- chainguard•amazon-eks-ami-fips
< 0
- chainguard•amazon-k8s-cni
< 1.23.0-r1 | < 0
- chainguard•amazon-k8s-cni-fips
< 1.23.0-r1 | < 0
- chainguard•amazon-k8s-cni-init
< 0
- chainguard•amazon-k8s-cni-init-fips
< 0
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.23.0-r1 | < 0
- chainguard•amazon-ssm-agent
< 0
- chainguard•amazon-ssm-agent-ecs-exec
< 0
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 0
- chainguard•amazon-ssm-agent-fips
< 0
- chainguard•amazon-vpc-cni-plugins
< 0
- chainguard•ansible-operator
< 1.42.3-r10
- chainguard•ansible-operator-fips
< 1.42.3-r7
- chainguard•apache-beam-java-11-sdk
< 0
- chainguard•apache-beam-java-17-sdk
< 0
- chainguard•apache-beam-java-21-sdk
< 0
- chainguard•apache-beam-python-3.13-sdk
< 0
- chainguard•apache-beam-python-3.14-sdk
< 0
- chainguard•apiserver-network-proxy-0.35
< 0.35.0-r4
- chainguard•apiserver-network-proxy-0.35-agent
< 0.35.0-r4
- chainguard•apiserver-network-proxy-0.36
< 0.36.0-r4
- chainguard•apiserver-network-proxy-0.36-agent
< 0.36.0-r4
- chainguard•apiserver-network-proxy-fips-0.34
< 0.34.0-r8
- chainguard•apiserver-network-proxy-fips-0.34-agent
< 0.34.0-r8
- chainguard•apiserver-network-proxy-fips-0.35
< 0.35.0-r7
- chainguard•apiserver-network-proxy-fips-0.35-agent
< 0.35.0-r7
- chainguard•apiserver-network-proxy-fips-0.36
< 0.36.0-r9
- chainguard•apiserver-network-proxy-fips-0.36-agent
< 0.36.0-r9
- chainguard•apko-fips
< 1.2.36-r1
Showing first 50 affected entries in server-rendered view.
References (8)
- https://go.dev/issue/80205
- https://go.dev/cl/795540
- https://groups.google.com/g/golang-announce/c/94pEornpRlI
- https://pkg.go.dev/vuln/GO-2026-6089
- https://security-tracker.debian.org/tracker/CVE-2026-56853
- https://ubuntu.com/security/CVE-2026-56853
- https://www.cve.org/CVERecord?id=CVE-2026-56853
- https://github.com/golang/go/issues/80205