Vulnerability · Published Feb 26, 2026 · Assigned by Go
CVE-2026-27141Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
High 7.5
In plain English
A high-severity null pointer dereference in golang.org/x/net/http2 from golang.org/x/net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | rclone | 1.73.5-r0 | ALPINE-CVE-2026-27141 |
| Go | golang.org/x/net | 0.51.0 | GO-2026-4559 |
| Ubuntu:26.04:LTS | adsys | 0.16.4ubuntu1.1 | UBUNTU-CVE-2026-27141 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| golang.org/x/net | golang.org/x/net/http2 | 0.50.0 – before 0.51.0 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H