CVE-2026-78659

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description HTTP/2 servers are susceptible to excessive memory allocation when processing "Trailer" headers sent by a client. The server uses these header values to populate the Request.Trailer map, and since each map entry incurs memory overhead, a malicious client can declare a large number of fields to exhaust server resources. This process bypasses the Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This issue does not affect HTTP/1 servers because they do not support multiplexing multiple requests over a single TCP connection and utilize different calculations for Server.MaxHeaderBytes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.