When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Project Subscriptions

Vendors Products
Go Standard Library Subscribe
Net/http Subscribe
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8471-1 containerd vulnerabilities
Ubuntu USN Ubuntu USN USN-8472-1 containerd vulnerabilities
Ubuntu USN Ubuntu USN USN-8473-1 containerd vulnerabilities
Ubuntu USN Ubuntu USN USN-8430-1 ADSys vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:22112 cve-icon
https://access.redhat.com/errata/RHSA-2026:22120 cve-icon
https://access.redhat.com/errata/RHSA-2026:22121 cve-icon
https://access.redhat.com/errata/RHSA-2026:23262 cve-icon
https://access.redhat.com/errata/RHSA-2026:23264 cve-icon
https://access.redhat.com/errata/RHSA-2026:33120 cve-icon
https://access.redhat.com/errata/RHSA-2026:33123 cve-icon
https://access.redhat.com/errata/RHSA-2026:33142 cve-icon
https://access.redhat.com/errata/RHSA-2026:33150 cve-icon
https://access.redhat.com/errata/RHSA-2026:34342 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:49702 cve-icon
https://access.redhat.com/errata/RHSA-2026:49712 cve-icon
https://access.redhat.com/errata/RHSA-2026:50205 cve-icon
https://access.redhat.com/errata/RHSA-2026:54274 cve-icon
https://access.redhat.com/errata/RHSA-2026:54283 cve-icon
https://access.redhat.com/errata/RHSA-2026:54284 cve-icon
https://access.redhat.com/errata/RHSA-2026:54285 cve-icon
https://access.redhat.com/errata/RHSA-2026:54286 cve-icon
https://access.redhat.com/errata/RHSA-2026:54287 cve-icon
https://access.redhat.com/errata/RHSA-2026:56854 cve-icon
https://access.redhat.com/errata/RHSA-2026:56912 cve-icon
https://access.redhat.com/errata/RHSA-2026:57191 cve-icon
https://access.redhat.com/errata/RHSA-2026:57194 cve-icon
https://access.redhat.com/errata/RHSA-2026:57365 cve-icon
https://access.redhat.com/errata/RHSA-2026:57367 cve-icon
https://access.redhat.com/errata/RHSA-2026:57408 cve-icon
https://access.redhat.com/errata/RHSA-2026:57545 cve-icon
https://access.redhat.com/errata/RHSA-2026:57649 cve-icon
https://access.redhat.com/errata/RHSA-2026:57845 cve-icon
https://access.redhat.com/errata/RHSA-2026:60520 cve-icon
https://access.redhat.com/errata/RHSA-2026:61253 cve-icon
https://access.redhat.com/security/cve/CVE-2026-33814 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2467815 cve-icon
https://go.dev/cl/761581 cve-icon cve-icon
https://go.dev/cl/761640 cve-icon cve-icon
https://go.dev/issue/78476 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/qcCIEXso47M cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-4918 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json cve-icon
History

Mon, 31 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
References

Fri, 28 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
References

Thu, 27 Aug 2026 13:30:00 +0000


Wed, 26 Aug 2026 15:45:00 +0000


Thu, 20 Aug 2026 13:30:00 +0000


Thu, 13 Aug 2026 13:30:00 +0000


Wed, 13 May 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-391
CWE-665

Wed, 13 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Golang go
Weaknesses CWE-835
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*
Vendors & Products Golang go

Fri, 08 May 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-391
CWE-665

Fri, 08 May 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-648
CWE-999

Fri, 08 May 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 07 May 2026 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-648
CWE-999

Thu, 07 May 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net/http
Golang
Golang http2
Vendors & Products Go Standard Library
Go Standard Library net/http
Golang
Golang http2

Thu, 07 May 2026 20:00:00 +0000

Type Values Removed Values Added
Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Title Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-31T12:04:25.088Z

Reserved: 2026-03-23T20:35:32.814Z

Link: CVE-2026-33814

cve-icon Vulnrichment

Updated: 2026-08-31T12:04:25.088Z

cve-icon NVD

Status : Modified

Published: 2026-05-07T20:16:42.880

Modified: 2026-08-31T13:17:46.090

Link: CVE-2026-33814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T03:15:13Z

Weaknesses