CVE-2026-97032: HTTP/2 server crash due to HPACK encoder race in net/http
Overview
- Severity
- Medium (CVSS 5.9)
- CVSS Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U
- Exploit Status
- Not Exploited
- Patch Tuesday
- 2026-Oct
- Released
- 2026-10-11
- Last Updated
- 2026-10-13
- EPSS Score
- 0.18% (percentile: 7.2%)
Affected Products (31)
Other
- 0-17084
- 21923-17084
- 21925-17084
- 21907-17084
- 21926-17084
- 21908-17084
- 21901-17084
- 21921-17084
- 21909-17084
- 21910-17084
- 21856-17084
- 21911-17084
- 21771-17084
- 21912-17084
- 21796-17084
- 21899-17084
- 21915-17084
- 21916-17084
- 21904-17084
- 21927-17084
- 21893-17084
- 21902-17084
- 17793-17084
- 21913-17084
- 21807-17084
- 21928-17084
- 21772-17084
- 21894-17084
- 21914-17084
- 21929-17084
- 21903-17084
Revision History
- 2026-10-11: Information published.
- 2026-10-13: Information published.