Http2 (Golang) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 56 known versions, newest CVE from 2026-05-07. Vendor: Golang.

CVEs of Http2

• CVE-2026-33814 - CVSS 7.5 (high), 2026-05-07: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a…
• CVE-2023-45288 - CVSS 7.5 (high), 2024-04-04: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK…
• CVE-2023-39325 - CVSS 7.5 (high), 2023-10-11: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number…
• CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
• CVE-2022-41723 - CVSS 7.5 (high), 2023-02-28: A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of…
• CVE-2022-41717 - CVSS 5.3 (medium), 2022-12-08: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by…