When a client sends a Trailer header, the Go HTTP server uses those header values to fill the Request.Trailer map that is passed to the handler. Because the map stores each entry, adding many trailers results in per‑entry memory overhead. An attacker can send a Trailer header that declares an excessive number of fields, causing the server to allocate far more memory than intended and bypass the Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits that normally restrain header size. The excessive allocation can exhaust available memory, leading to application failure or degraded performance, and effectively triggers a denial of service. The described weakness is consistent with a resource‑exhaustion flaw.

This issue affects any Go application that uses the standard library packages net/http, net/http/internal/http2, or golang.org/x/net/http2 and runs an HTTP/2 server. No specific version was listed, so all versions until the patch are potentially vulnerable.

The vulnerability can be exploited by any network client that has access to an HTTP/2 endpoint. It does not apply to HTTP/1 servers, as they do not support the same multiplexing of requests and calculate limits differently. The EPSS score is < 1%, indicating a low probability of exploitation in the wild, while the CVSS score of 7.5 reflects a high impact if the attack succeeds. The issue is not listed in CISA’s KEV catalog, further reducing the likelihood of known exploitation. The lack of built‑in limits makes the exploitation straightforward for an attacker who can send a large number of trailer fields over a single connection.