CVE-2026-33814

Published: May 7, 2026Modified: Jul 24, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected (3)

Products: Golang: Go, Http2

Golang

2 products

Http2

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.25.10
Golang Go	From 1.26.0 to 1.26.3
Golang Http2	Before 0.53.0

Related CWEs

CWE-606

Unchecked Input for Loop Condition

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (18)

https://go.dev/cl/761581

Source: security@golang.org

Patch

https://go.dev/cl/761640

Source: security@golang.org

Patch

https://go.dev/issue/78476

Source: security@golang.org

Issue TrackingMailing List

https://groups.google.com/g/golang-announce/c/qcCIEXso47M

Source: security@golang.org

Release Notes

https://pkg.go.dev/vuln/GO-2026-4918

Source: security@golang.org

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:23262