Log in Start free

Vulnerability · Published May 7, 2026 · Assigned by Go

CVE-2026-33814Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

High 7.5

In plain English

A high-severity security flaw in net/http from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 42.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2026:22112
AlmaLinux:8go-toolset1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9go-toolset1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-bin1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-bin1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-docs1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-docs1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-misc1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-misc1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-race1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-race1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-src1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-src1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-tests1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-tests1.26.3-1.el9_8ALSA-2026:22121
Alpine:v3.23go1.25.10-r0ALPINE-CVE-2026-33814
Alpine:v3.24go1.26.3-r0ALPINE-CVE-2026-33814
Alpine:v3.24rclone1.74.1-r0ALPINE-CVE-2026-33814
Debian:12golang-golang-x-netno fix listedDEBIAN-CVE-2026-33814
Debian:13golang-golang-x-netno fix listedDEBIAN-CVE-2026-33814
Debian:14golang-golang-x-net1:0.53.0-1DEBIAN-CVE-2026-33814
Gogolang.org/x/net0.53.0GO-2026-4918
Gostdlib1.25.10, 1.26.3GO-2026-4918
Rocky Linux:8delve0:1.25.2-1.module+el8.10.0+40035+ee0a7047RLSA-2026:22112
Rocky Linux:10golang0:1.26.3-4.el10_2RLSA-2026:22120
Rocky Linux:8golang0:1.25.10-1.module+el8.10.0+40200+0fd0f175RLSA-2026:22112
Rocky Linux:9golang0:1.26.3-1.el9_8RLSA-2026:22121
Ubuntu:22.04:LTSadsys0.16.3~22.04.2ubuntu0.22.04.1UBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSadsys0.16.3~24.04.2ubuntu0.24.04.1UBUNTU-CVE-2026-33814
Ubuntu:25.10adsys0.16.3ubuntu0.25.10.2UBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSadsys0.16.4ubuntu1.1UBUNTU-CVE-2026-33814
Ubuntu:22.04:LTScontainerd1.6.12-0ubuntu1~22.04.11UBUNTU-CVE-2026-33814
Ubuntu:22.04:LTScontainerd-app2.2.1-0ubuntu1~22.04.2UBUNTU-CVE-2026-33814
Ubuntu:24.04:LTScontainerd-app2.2.1-0ubuntu1~24.04.3UBUNTU-CVE-2026-33814
Ubuntu:25.10containerd-app2.2.1-0ubuntu1~25.10.2UBUNTU-CVE-2026-33814
Ubuntu:26.04:LTScontainerd-app2.2.2-0ubuntu1.1UBUNTU-CVE-2026-33814
Ubuntu:25.10containerd-stable2.1.6-0ubuntu1~25.10.2UBUNTU-CVE-2026-33814
Ubuntu:26.04:LTScontainerd-stable2.2.2-0ubuntu1.1UBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.10golang-1.26no fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.10golang-1.27no fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgolang-golang-x-netno fix listedUBUNTU-CVE-2026-33814
Ubuntu:25.10golang-golang-x-netno fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSgolang-golang-x-netno fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.10golang-golang-x-netno fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:25.10google-guest-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.10google-guest-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:22.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:24.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-33814
Ubuntu:26.10google-osconfig-agentno fix listedUBUNTU-CVE-2026-33814

Affected products (as reported)

VendorProductVersions
golang.org/x/net golang.org/x/net/http2 0 – before 0.53.0
Go standard library net/http 0 – before 1.25.101.26.0-0 – before 1.26.3

Weakness: CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References