CVE-2026-56853
CVE
Medium
Medium Impactnet/http: ReadHeaderTimeout Not Applied During Unencrypted HTTP/2 Preface Check
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Only reachable when KrakenD’s HTTP server is configured to accept unencrypted
HTTP/2 (h2c). Deployments terminating TLS or running HTTP/1.1-only are not exposed
to the unbounded read.
Component
Go standard library (net/http)
Disclosed
Aug 14, 2026
Description
When a Go HTTP server is configured to accept unencrypted HTTP/2 (h2c), it peeks a
few bytes off each new connection to detect the HTTP/2 client preface before deciding
how to handle the request. That initial read did not honor the server’s configured
ReadHeaderTimeout, so a client that opens a connection and never sends data could
hold it open indefinitely. An attacker opening many such connections can exhaust
server resources, a slow-connection denial of service.Version summary
Community Edition
2.13.9
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.