The vulnerability occurs when a Go net/http server is configured to accept unencrypted HTTP/2 connections. The server reads a small amount of data from each new connection to check for the HTTP/2 client preface, but the ReadHeaderTimeout that should limit how long a client can delay sending data is not applied during this check. An attacker can open many connections and hold them open longer than allowed, consuming server resources until the server becomes unable to accept new connections. This is a classic resource exhaustion weakness (CWE‑770). The description does not specify exact Go patch versions, so any Go release prior to the fix referenced in go.dev/cl/795540 is potentially vulnerable.

All installations of the Go standard library net/http that enable unencrypted HTTP/2 and are running a pre‑patch version. The description does not specify exact Go patch versions, so any Go release prior to the fix referenced in go.dev/cl/795540 is potentially vulnerable.

The exploit vector is network‑based: only a remote client that can connect to the server is required. The inherent vulnerability allows indefinite reads until a client disconnects or the server times out; however, no current exploit is documented and the EPSS score is < 1%. The issue is not listed in CISA’s KEV catalog. Attackers would need to generate a large number of slow connections to achieve a denial of service, so the operational impact is moderate to high depending on server load and mitigation measures. The CVSS score of 7.5 indicates a high severity vulnerability.