CVE-2026-97032

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description HTTP/2 servers may crash due to concurrent modification of the HPACK encoder. This occurs when the server modifies the encoder from two goroutines without synchronization: one encoding a HEADERS frame for a client response, and another modifying the encoder table size while processing a SETTINGS frame containing SETTINGS HEADER TABLE SIZE sent by a client. A malicious actor can trigger this crash by repeatedly sending requests while simultaneously changing the header table size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.