CVE-2026-78663

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The HTTP/2 server incorrectly refunds connection-level flow control twice for the same data. This occurs when a client resets a stream, refunding data for the sent-but-unread portion, and again when a request handler reads that buffered data. A malicious client can use this behavior to bypass the MaxReceiveBufferPerConnection connection-level flow control limit. Total buffered data remains limited by the stream-level flow control and the concurrent stream limit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.