Go 1.27.2 and 1.26.9 Ship Security Fixes Including an HTTP/2 Server Crash and a CONNECT Response-Poisoning Bug in net/http
Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.
Overview
The Go project released Go 1.27.2 and Go 1.26.9 on October 8, 2026. According to the Go release history, Go 1.27.2 “includes security fixes to the go command, and the crypto/tls, html/template, net/http, net/textproto, and os packages,” along with bug fixes to the compiler, the linker, the runtime and several other components. The same page lists Go 1.26.9 as released on 2026-10-08 with an identical list of security-fixed components.
The Go vulnerability database published entries for the release the same day. This briefing covers four of them that the database describes in detail.
What We Know
HTTP/2 server crash (CVE-2026-97032)
The Go vulnerability database entry GO-2026-6617 says: “HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.” The entry explains that the server modifies the HPACK encoder from two goroutines without synchronization: one encodes a HEADERS frame as part of a response, and the other changes the encoder’s table size when handling a SETTINGS frame that carries SETTINGS_HEADER_TABLE_SIZE from a client. According to the entry, a malicious client can repeatedly send a request while changing the header table size to crash the server.
The entry lists net/http as affected before go1.26.9, and net/http/internal/http2 as affected from go1.27.0-0 before go1.27.2. It credits RyotaK of GMO Flatt Security Inc.
CONNECT request desynchronization (CVE-2026-56866)
The entry GO-2026-6605 concerns http.Transport sending an HTTP/1 CONNECT request with a non-empty Request.Body. It says the transport writes that body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the Transport returns the connection to the idle pool.
Because CONNECT requests do not have a request body, the entry says, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request, leaving the pooled connection desynchronized. The next caller that reuses it reads the response to the injected request. The entry states that in reverse proxies, including httputil.ReverseProxy, that forward CONNECT requests through a shared Transport, “this can lead to cross-user response poisoning.” Affected ranges are net/http and net/http/httputil before go1.26.9, and from go1.27.0-0 before go1.27.2. The credit line names Xclow3n (Rajat Raghav).
Range header CPU consumption (CVE-2026-78667)
The entry GO-2026-6609 says that when parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent and ServeFile(FS) can consume an excessive amount of CPU. It lists net/http as affected before go1.26.9, and from go1.27.0-0 before go1.27.2, and credits Jakub Ciolek.
html/template yield keyword (CVE-2026-97030)
The entry GO-2026-6600 says a trusted template author may have previously written a valid template in which use of the ‘yield’ keyword would not be correctly escaped. The fix, it says, ensures that valid keyword uses are escaped and non-keyword uses are not escaped. The affected package is html/template, before go1.26.9 and from go1.27.0-0 before go1.27.2.
Other fixes in the milestone
The Go 1.27.2 milestone on GitHub lists cherry-picked issues beyond these four. Titles there include “html/template: XSS via stale jsCtx at template-literal expression entry, tJSTmpl ${ [1.27 backport]”, “cmd/go: malicious GOMODPROXY can cause golang.org/toolchain checksum bypass [1.27 backport]” and a matching entry for golang.org/fips140. Several more are titled only “security: fix CVE-…” with a CVE identifier, including CVE-2026-78659, CVE-2026-97031, CVE-2026-94439, CVE-2026-78663, CVE-2026-78669, CVE-2026-94440 and CVE-2026-56857. Non-security entries include “net/http: Request.TLS is not properly populated for HTTP/2 requests [1.27 backport]”.
What We Don’t Know
- Detailed descriptions for the CVEs that appear in the milestone only as “security: fix CVE-…” titles were not available in the sources reviewed here, so their impact is not described in this briefing.
- The vulnerability entries do not report whether any of these flaws has been exploited in the wild.
- The release history page lists the affected components in general terms; it does not map each CVE to a severity rating.
Analysis
For operators, the practical reading of the entries is a version check. Servers built with Go before 1.26.9, or on the 1.27 line before 1.27.2, fall within the affected ranges the database lists for the four flaws above. Applications that run HTTP/2 servers, forward CONNECT requests through a shared Transport, serve files with ServeContent or ServeFile, or render html/template output are the ones the entries name.