CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

• CWE-770

• https://go.dev/cl/826504Patch
• https://go.dev/issue/81316Issue Tracking, Vendor Advisory
• https://groups.google.com/g/golang-announce/c/1y3fb2np35UMailing List, Vendor Advisory
• https://pkg.go.dev/vuln/GO-2026-6354Patch, Vendor Advisory

Published

Sep 2, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78657The SigmaForms Pro – AI Generated Forms plugin for WordPress…9.8
• CVE-2026-78658IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3…6.5
• CVE-2026-78659When "Trailer" headers are sent by a client, the HTTP server…7.5
• CVE-2026-7866Stack-based Buffer Overflow vulnerability in RTI Connext Pro…10
• CVE-2026-78660Historically, we have been rather lax about malformed framin…7.5
• CVE-2026-78661When coalescing adjacent text nodes in addText and fosterPar…7.5
• CVE-2026-78663The HTTP/2 server can refund connection-level flow control t…9.1
• CVE-2026-78667When parsing a Range header containing a large number of sma…7.5
• CVE-2026-78668Rejected reason: reserved but not needed
• CVE-2026-78669A malicious HTTP/2 peer can cause excessive CPU consumption …7.5
• CVE-2026-7867A flaw was found in udisks2. A local attacker with an active…7.8
• CVE-2026-78673IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote …7.5