Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-27141

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/net golang.org/x/net/http2

Default version status: unaffected

  • 0.50.0 to < 0.51.0affected

References