The vulnerability occurs in Go's HTTP/2 server implementation within the net/http and golang.org/x/net/http2 packages. It incorrectly refunds flow‑control credit twice: once when a client resets a stream, and again when the request handler reads the buffered data. This double refund breaks the MaxReceiveBufferPerConnection limit, letting a malicious client send data, reset the stream, and force the server to allocate more memory than intended. The flaw is a result of improper flow‑control credit management and could enable an attacker to cause memory growth bounded only by the concurrent stream and stream‑level flow‑control limits.

Any Go application that uses the standard library packages net/http, net/http/internal/http2, or the golang.org/x/net/http2 library is affected. All Go distributions containing these packages are vulnerable; specific version ranges are not yet published publicly.

The CVSS score of 9.1 indicates critical severity, and the EPSS score of less than 1 % suggests a very low but nonzero probability of exploitation. It is not listed in CISA’s KEV catalog. Attacks would originate from a remote HTTP/2 client that can repeatedly send data and reset to trigger the double refund, potentially leading to memory growth bounded only by the concurrent stream limit and stream‑level flow control. The repeated reset pattern is inferred from the description, as the vulnerable refund logic can be abused by a client that triggers multiple resets to bypass the connection‑level flow control. No publicly known exploit exists, and no official patch is currently available; however, the design flaw permits a modest risk of denial of service if an adversary can sustain the reset pattern.