Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/net golang.org/x/net/http2

Default version status: unaffected

  • 0 to < 0.53.0affected

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.25.10affected
  • 1.26.0-0 to < 1.26.3affected

References