CVE-2026-33814
CVE-2026-33814 · Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVSS 7.5 · High · EPSS 0.8% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
golang.org/x/net/http2
- Versions
- ≥ 0, < 0.53.0: Affected (semver)
Update to 0.53.0
net/http
- Versions
- ≥ 0, < 1.25.10: Affected (semver)
- ≥ 1.26.0-0, < 1.26.3: Affected (semver)
Update to 1.25.10; Update to 1.26.3
golang-golang-x-net Debian:12
- Versions
- 1:0.10.0-1
- 1:0.11.0-1
- 1:0.14.0-1
- 1:0.15.0-1
- 1:0.15.0-2
- 1:0.17.0+dfsg-1
- 1:0.19.0+dfsg-1
- 1:0.20.0+dfsg-1
- 1:0.21.0+dfsg-1
- 1:0.22.0+dfsg-1
- 1:0.23.0+dfsg-1
- 1:0.24.0+dfsg-1
- 1:0.25.0+dfsg-1
- 1:0.26.0+dfsg-1
- 1:0.26.0+dfsg-2
- 1:0.27.0-1
- 1:0.27.0-2
- 1:0.47.0-1
- 1:0.47.0-2
- 1:0.53.0-1
- 1:0.53.0-2
- 1:0.53.0-2~bpo13+1
- 1:0.55.0-1
- 1:0.56.0-1
- 1:0.57.0-1
- 1:0.58.0-1
- 1:0.7.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net Debian:13
- Versions
- 1:0.27.0-2
- 1:0.47.0-1
- 1:0.47.0-2
- 1:0.53.0-1
- 1:0.53.0-2
- 1:0.53.0-2~bpo13+1
- 1:0.55.0-1
- 1:0.56.0-1
- 1:0.57.0-1
- 1:0.58.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net Debian:14
- Versions
- 1:0.27.0-2
- 1:0.47.0-1
- 1:0.47.0-2
- Affected ranges
- ECOSYSTEM: < 1:0.53.0-1
Update to 1:0.53.0-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net-dev Ubuntu:Pro:16.04:LTS
- Versions
- 0.0+git20150226.3d87fd6-3
- 0.0+git20151007.b846920+dfsg-1
- 1:0.0+git20150817.66f0418-1
- 1:0.0+git20160110.4fd4a9f-1
- 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
- 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
juju-core Ubuntu:Pro:16.04:LTS
- Versions
- 1.24.6-0ubuntu3
- 1.25.0-0ubuntu1
- 1.25.0-0ubuntu2
- 1.25.0-0ubuntu3
- 2.0~beta4-0ubuntu2
- 2.0~beta6-0ubuntu1.16.04.1
- 2.0~beta7-0ubuntu1.16.04.1
- 2.0~beta12-0ubuntu1.16.04.1
- 2.0~beta15-0ubuntu2.16.04.1
- 2.0.0-0ubuntu0.16.04.2
- 2.0.2-0ubuntu0.16.04.1
- 2.0.2-0ubuntu0.16.04.2
- 2.3.1-0ubuntu0.16.04.1
- 2.3.2-0ubuntu0.16.04.1
- 2.3.7-0ubuntu0.16.04.1
- 2.3.7-0ubuntu0.16.04.1+esm1
- 2.3.7-0ubuntu0.16.04.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:16.04:LTS
- Versions
- 0.20-0ubuntu4
- 0.21-0ubuntu3
- 0.21-0ubuntu5
- 0.22-0ubuntu1
- 0.22-0ubuntu2
- 0.23-0ubuntu1
- 0.23-0ubuntu2
- 0.23-0ubuntu3
- 0.24-0ubuntu2
- 0.24-0ubuntu3
- 0.24-0ubuntu4
- 0.25-0ubuntu1
- 0.26-0ubuntu2
- 0.26-0ubuntu3
- 0.27-0ubuntu1
- 0.27-0ubuntu2
- 2.0.0~beta1-0ubuntu3
- 2.0.0~beta1-0ubuntu4
- 2.0.0~beta2-0ubuntu1
- 2.0.0~beta2-0ubuntu2
- 2.0.0~beta3-0ubuntu1
- 2.0.0~beta3-0ubuntu2
- 2.0.0~beta3-0ubuntu3
- 2.0.0~beta3-0ubuntu4
- 2.0.0~beta4-0ubuntu1
- 2.0.0~beta4-0ubuntu2
- 2.0.0~beta4-0ubuntu3
- 2.0.0~beta4-0ubuntu4
- 2.0.0~beta4-0ubuntu5
- 2.0.0~beta4-0ubuntu6
- 2.0.0~beta4-0ubuntu7
- 2.0.0~rc1-0ubuntu1
- 2.0.0~rc1-0ubuntu2
- 2.0.0~rc1-0ubuntu3
- 2.0.0~rc2-0ubuntu2
- 2.0.0~rc2-0ubuntu3
- 2.0.0~rc3-0ubuntu1
- 2.0.0~rc3-0ubuntu2
- 2.0.0~rc3-0ubuntu3
- 2.0.0~rc3-0ubuntu4
- 2.0.0~rc4-0ubuntu1
- 2.0.0~rc5-0ubuntu1
- 2.0.0~rc6-0ubuntu1
- 2.0.0~rc6-0ubuntu2
- 2.0.0~rc7-0ubuntu1
- 2.0.0~rc7-0ubuntu2
- 2.0.0~rc8-0ubuntu1
- 2.0.0~rc8-0ubuntu2
- 2.0.0~rc8-0ubuntu3
- 2.0.0~rc8-0ubuntu5
- 2.0.0~rc8-0ubuntu6
- 2.0.0~rc8-0ubuntu7
- 2.0.0~rc9-0ubuntu2
- 2.0.0~rc9-0ubuntu3
- 2.0.0~rc9-0ubuntu4
- 2.0.0~rc9-0ubuntu5
- 2.0.0-0ubuntu1
- 2.0.0-0ubuntu2
- 2.0.0-0ubuntu3
- 2.0.0-0ubuntu4
- 2.0.1-0ubuntu1~16.04.1
- 2.0.2-0ubuntu1~16.04.1
- 2.0.3-0ubuntu1~ubuntu16.04.2
- 2.0.4-0ubuntu1~ubuntu16.04.1
- 2.0.5-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.1
- 2.0.8-0ubuntu1~ubuntu16.04.2
- 2.0.9-0ubuntu1~16.04.1
- 2.0.9-0ubuntu1~16.04.2
- 2.0.10-0ubuntu1~16.04.1
- 2.0.10-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.2
- 2.0.11-0ubuntu1~16.04.4
- 2.0.11-0ubuntu1~16.04.4+esm1
- 2.0.11-0ubuntu1~16.04.4+esm2
- 2.0.11-0ubuntu1~16.04.4+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
containerd Ubuntu:Pro:16.04:LTS
- Versions
- 0.2.1-0ubuntu4~16.04
- 0.2.3-0ubuntu1~16.04
- 0.2.5-0ubuntu1~16.04.1
- 1.2.6-0ubuntu1~16.04.2
- 1.2.6-0ubuntu1~16.04.3
- 1.2.6-0ubuntu1~16.04.4
- 1.2.6-0ubuntu1~16.04.5
- 1.2.6-0ubuntu1~16.04.6
- 1.2.6-0ubuntu1~16.04.6+esm1
- 1.2.6-0ubuntu1~16.04.6+esm2
- 1.2.6-0ubuntu1~16.04.6+esm4
- 1.2.6-0ubuntu1~16.04.6+esm5
- 1.2.6-0ubuntu1~16.04.6+esm6
- Affected ranges
- ECOSYSTEM: < 1.2.6-0ubuntu1~16.04.6+esm7
Update to 1.2.6-0ubuntu1~16.04.6+esm7
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- 1.18.1-1ubuntu1~16.04.6+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-guest-agent Ubuntu:Pro:16.04:LTS
- Versions
- 20201217.02-0ubuntu1~16.04.0
- 20230426.00-0ubuntu2~16.04.3
- 20231004.02-0ubuntu1~16.04.1
- 20231004.02-0ubuntu1~16.04.2
- 20240716.00-0ubuntu1~16.04.0
- 20240716.00-0ubuntu1~16.04.0+esm1
- 20240716.00-0ubuntu1~16.04.0+esm2
- 20240716.00-0ubuntu1~16.04.0+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
google-osconfig-agent Ubuntu:Pro:16.04:LTS
- Versions
- 20210219.00-0ubuntu1~16.04.0
- 20230504.00-0ubuntu1~16.04.0
- 20240320.00-0ubuntu1~16.04.0
- 20240524.03-0ubuntu2~16.04.0
- 20251028.00-0ubuntu2~16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Ubuntu:Pro:18.04:LTS
- Versions
- 2.18-0ubuntu6
- 2.19-0ubuntu1
- 2.20-0ubuntu3
- 2.20-0ubuntu4
- 2.21-0ubuntu1
- 2.21-0ubuntu2
- 2.21-0ubuntu3
- 2.21-0ubuntu4
- 3.0.0~beta2-0ubuntu3
- 3.0.0~beta3-0ubuntu3
- 3.0.0~beta5-0ubuntu2
- 3.0.0~beta7-0ubuntu1
- 3.0.0-0ubuntu1
- 3.0.0-0ubuntu2
- 3.0.0-0ubuntu3
- 3.0.0-0ubuntu4
- 3.0.1-0ubuntu1~18.04.1
- 3.0.2-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.1
- 3.0.3-0ubuntu1~18.04.2
- 3.0.3-0ubuntu1~18.04.2+esm1
- 3.0.3-0ubuntu1~18.04.2+esm2
- 3.0.3-0ubuntu1~18.04.2+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
containerd Ubuntu:Pro:18.04:LTS
- Versions
- 0.2.5-0ubuntu2
- 1.2.6-0ubuntu1~18.04.1
- 1.2.6-0ubuntu1~18.04.2
- 1.3.3-0ubuntu1~18.04.1
- 1.3.3-0ubuntu1~18.04.2
- 1.3.3-0ubuntu1~18.04.3
- 1.3.3-0ubuntu1~18.04.4
- 1.4.4-0ubuntu1~18.04.2
- 1.5.2-0ubuntu1~18.04.1
- 1.5.2-0ubuntu1~18.04.2
- 1.5.2-0ubuntu1~18.04.3
- 1.5.5-0ubuntu3~18.04.1
- 1.5.5-0ubuntu3~18.04.2
- 1.5.9-0ubuntu1~18.04.1
- 1.5.9-0ubuntu1~18.04.2
- 1.6.12-0ubuntu1~18.04.1
- 1.6.12-0ubuntu1~18.04.1+esm1
- 1.6.12-0ubuntu1~18.04.1+esm2
- 1.6.12-0ubuntu1~18.04.1+esm3
- Affected ranges
- ECOSYSTEM: < 1.6.12-0ubuntu1~18.04.1+esm4
Update to 1.6.12-0ubuntu1~18.04.1+esm4
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- 1.18.1-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://go.dev/cl/761581
- https://go.dev/cl/761640
- https://go.dev/issue/78476
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4918
- https://access.redhat.com/security/cve/CVE-2026-33814
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json
- https://access.redhat.com/errata/RHSA-2026:66350
- https://access.redhat.com/errata/RHSA-2026:63091
- https://access.redhat.com/errata/RHSA-2026:57845
- https://access.redhat.com/errata/RHSA-2026:63636
- https://access.redhat.com/errata/RHSA-2026:63637
- https://access.redhat.com/errata/RHSA-2026:60668
- https://access.redhat.com/errata/RHSA-2026:63639
- https://access.redhat.com/errata/RHSA-2026:49702
- https://access.redhat.com/errata/RHSA-2026:22120
- https://access.redhat.com/errata/RHSA-2026:22112
- https://access.redhat.com/errata/RHSA-2026:61253
- https://access.redhat.com/errata/RHSA-2026:57649
- https://access.redhat.com/errata/RHSA-2026:49712
- https://access.redhat.com/errata/RHSA-2026:22121
- https://access.redhat.com/errata/RHSA-2026:34342
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814