curl 8.23.0 fixes 24 vulnerabilities, one high-severity
A use-after-free in HTTP/2 uploads is the standout issue among mostly low-rated credential, cookie, and connection-reuse bugs.
By chroot#http2
Go patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfault