CVE-2026-33814
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - security@golang.org
- Published
- 2026-05-07
- Last modified
- 2026-10-26
- Weaknesses
- CWE-606, CWE-835
Affected products
- Nethttp (Go Standard Library)
- Go (Golang)
- Http2 (Golang)
- Golang.orgxnethttp2 (Golang.orgxnet)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Ansible Automation Platform (Redhat)
- Assisted Installer (Redhat)
- Ceph Storage (Redhat)
- Cert Manager (Redhat)
- Certifications (Redhat)
- Cluster Observability Operator (Redhat)
- Confidential Compute Attestation (Redhat)
- Connectivity Link (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Deployment Validator Operator (Redhat)
- Devworkspace (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Enterprise Linux Eus (Redhat)
- Ext Dns Optr (Redhat)
- External Secrets Operator (Redhat)
- Gatekeeper (Redhat)
- Hummingbird (Redhat)
- Lightspeed For Runtimes (Redhat)
- Logging (Redhat)
- Lvms (Redhat)
- Migration Toolkit Applications (Redhat)
- Multiarch Tuning Operator (Redhat)
- Multicluster Engine (Redhat)
- Multicluster Globalhub (Redhat)
- Network Observ Optr (Redhat)
- Ocp Tools (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Api Data Protection (Redhat)
- Openshift Builds (Redhat)
- Openshift Cluster Manager Cli (Redhat)
- Openshift Compliance Operator (Redhat)
- Openshift Custom Metrics Autoscaler (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift File Integrity Operator (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Openshift Power Monitoring (Redhat)
- Openshift Security Profiles Operator (Redhat)
- Openshift Service On Aws (Redhat)
- Openstack (Redhat)
- Quay (Redhat)
- Red Hat 3scale Amp (Redhat)
- Rhdh (Redhat)
- Rhel E4s (Redhat)
- Rhel Eus (Redhat)
- Rhmt (Redhat)
- Satellite (Redhat)
- Secrets Management Console (Redhat)
- Serverless (Redhat)
- Service Interconnect (Redhat)
- Service Mesh (Redhat)
- Trusted Artifact Signer (Redhat)
- Webterminal (Redhat)
- Windows Machine Config (Redhat)
- Workload Availability Far (Redhat)
- Workload Availability Mdr (Redhat)
- Workload Availability Nhc (Redhat)
- Workload Availability Nmo (Redhat)
- Workload Availability Sbr (Redhat)
- Workload Availability Snr (Redhat)
- Zero Trust Workload Identity Manager (Redhat)
References
- https://go.dev/cl/761581
- https://go.dev/cl/761640
- https://go.dev/issue/78476
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4918
- https://access.redhat.com/security/cve/CVE-2026-33814
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json
- https://access.redhat.com/errata/RHSA-2026:66350
- https://access.redhat.com/errata/RHSA-2026:63091
- https://access.redhat.com/errata/RHSA-2026:57845
- https://access.redhat.com/errata/RHSA-2026:63636
- https://access.redhat.com/errata/RHSA-2026:63637
- https://access.redhat.com/errata/RHSA-2026:60668
- https://access.redhat.com/errata/RHSA-2026:63639
- https://access.redhat.com/errata/RHSA-2026:49702
- https://access.redhat.com/errata/RHSA-2026:22120
- https://access.redhat.com/errata/RHSA-2026:22112
- https://access.redhat.com/errata/RHSA-2026:61253
- https://access.redhat.com/errata/RHSA-2026:57649
- https://access.redhat.com/errata/RHSA-2026:49712
- https://access.redhat.com/errata/RHSA-2026:22121
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:57191
- https://access.redhat.com/errata/RHSA-2026:23262
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:60520
