Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Summary
| CVE | CVE-2026-33814 |
|---|---|
| State | PUBLISHED |
| Assigner | Go |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-07 20:16:42 UTC |
| Updated | 2026-08-21 13:17:27 UTC |
| Description | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.000190000 probability, percentile 0.052620000 (date 2026-05-12)
Problem Types: CWE-835 | CWE-606 | CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') | CWE-606 Unchecked Input for Loop Condition
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:57194 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:57191 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54284 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:43692 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:23262 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54274 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/issue/78476 | [email protected] | go.dev | Issue Tracking, Mailing List |
| go.dev/cl/761581 | [email protected] | go.dev | Patch |
| access.redhat.com/errata/RHSA-2026:34342 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:42644 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37387 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/cl/761640 | [email protected] | go.dev | Patch |
| access.redhat.com/errata/RHSA-2026:54286 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54283 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33123 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:50205 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:23264 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54287 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33120 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| groups.google.com/g/golang-announce/c/qcCIEXso47M | [email protected] | groups.google.com | Release Notes |
| access.redhat.com/security/cve/CVE-2026-33814 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33142 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54285 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| pkg.go.dev/vuln/GO-2026-4918 | [email protected] | pkg.go.dev | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:33150 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Marwan Atia ([email protected]) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-05-07T20:01:11.324Z | Reported to Red Hat. |
| ADP | 2026-05-07T19:41:17.631Z | Made public. |
Solutions
ADP: RHSA-2026:34342: Cluster Observability Operator 1.5.0
ADP: RHSA-2026:43692: OpenShift API for Data Protection 1.6
ADP: RHSA-2026:57191: Red Hat Advanced Cluster Management for Kubernetes 2.16
ADP: RHSA-2026:23262: Red Hat Hardened Images
ADP: RHSA-2026:23264: Red Hat Hardened Images
ADP: RHSA-2026:42644: Red Hat OpenShift AI 2.25
ADP: RHSA-2026:33120: Red Hat OpenShift Service Mesh 3.0
ADP: RHSA-2026:33123: Red Hat OpenShift Service Mesh 3.1
ADP: RHSA-2026:33142: Red Hat OpenShift Service Mesh 3.2
ADP: RHSA-2026:33150: Red Hat OpenShift Service Mesh 3.3
ADP: RHSA-2026:54287: Red Hat OpenShift Workload Availability 0.12
ADP: RHSA-2026:54284: Red Hat OpenShift Workload Availability 0.13
ADP: RHSA-2026:54286: Red Hat OpenShift Workload Availability 0.3
ADP: RHSA-2026:54285: Red Hat OpenShift Workload Availability 0.7
ADP: RHSA-2026:54274: Red Hat OpenShift Workload Availability 0.8
ADP: RHSA-2026:54283: Red Hat OpenShift Workload Availability 5.7
ADP: RHSA-2026:50205: Red Hat OpenShift distributed tracing 3.10.1
ADP: RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22
ADP: RHSA-2026:57194: multicluster engine for Kubernetes 2.11
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.