Description
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Published: 2026-05-07
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8471-1 containerd vulnerabilities
Ubuntu USN Ubuntu USN USN-8472-1 containerd vulnerabilities
Ubuntu USN Ubuntu USN USN-8473-1 containerd vulnerabilities
Ubuntu USN Ubuntu USN USN-8430-1 ADSys vulnerabilities
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:22112 cve-icon
https://access.redhat.com/errata/RHSA-2026:22120 cve-icon
https://access.redhat.com/errata/RHSA-2026:22121 cve-icon
https://access.redhat.com/errata/RHSA-2026:23262 cve-icon
https://access.redhat.com/errata/RHSA-2026:23264 cve-icon
https://access.redhat.com/errata/RHSA-2026:33120 cve-icon
https://access.redhat.com/errata/RHSA-2026:33123 cve-icon
https://access.redhat.com/errata/RHSA-2026:33142 cve-icon
https://access.redhat.com/errata/RHSA-2026:33150 cve-icon
https://access.redhat.com/errata/RHSA-2026:34342 cve-icon
https://access.redhat.com/errata/RHSA-2026:37387 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:49702 cve-icon
https://access.redhat.com/errata/RHSA-2026:49712 cve-icon
https://access.redhat.com/errata/RHSA-2026:50205 cve-icon
https://access.redhat.com/errata/RHSA-2026:54274 cve-icon
https://access.redhat.com/errata/RHSA-2026:54283 cve-icon
https://access.redhat.com/errata/RHSA-2026:54284 cve-icon
https://access.redhat.com/errata/RHSA-2026:54285 cve-icon
https://access.redhat.com/errata/RHSA-2026:54286 cve-icon
https://access.redhat.com/errata/RHSA-2026:54287 cve-icon
https://access.redhat.com/errata/RHSA-2026:56854 cve-icon
https://access.redhat.com/errata/RHSA-2026:56912 cve-icon
https://access.redhat.com/errata/RHSA-2026:57191 cve-icon
https://access.redhat.com/errata/RHSA-2026:57194 cve-icon
https://access.redhat.com/errata/RHSA-2026:57365 cve-icon
https://access.redhat.com/errata/RHSA-2026:57367 cve-icon
https://access.redhat.com/errata/RHSA-2026:57408 cve-icon
https://access.redhat.com/errata/RHSA-2026:57545 cve-icon
https://access.redhat.com/errata/RHSA-2026:57649 cve-icon
https://access.redhat.com/errata/RHSA-2026:57845 cve-icon
https://access.redhat.com/errata/RHSA-2026:60520 cve-icon
https://access.redhat.com/security/cve/CVE-2026-33814 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2467815 cve-icon
https://go.dev/cl/761581 cve-icon cve-icon
https://go.dev/cl/761640 cve-icon cve-icon
https://go.dev/issue/78476 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/qcCIEXso47M cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-4918 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json cve-icon
History

Fri, 28 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
References

Thu, 27 Aug 2026 13:30:00 +0000


Wed, 26 Aug 2026 15:45:00 +0000


Thu, 20 Aug 2026 13:30:00 +0000


Thu, 13 Aug 2026 13:30:00 +0000


Wed, 13 May 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-391
CWE-665

Wed, 13 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Golang go
Weaknesses CWE-835
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*
Vendors & Products Golang go

Fri, 08 May 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-391
CWE-665

Fri, 08 May 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-648
CWE-999

Fri, 08 May 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 07 May 2026 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-648
CWE-999

Thu, 07 May 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net/http
Golang
Golang http2
Vendors & Products Go Standard Library
Go Standard Library net/http
Golang
Golang http2

Thu, 07 May 2026 20:00:00 +0000

Type Values Removed Values Added
Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Title Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
References

Subscriptions

Go Standard Library Net/http
Golang Go Http2
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-28T12:04:29.559Z

Reserved: 2026-03-23T20:35:32.814Z

Link: CVE-2026-33814

cve-icon Vulnrichment

Updated: 2026-08-26T12:05:02.890Z

cve-icon NVD

Status : Modified

Published: 2026-05-07T20:16:42.880

Modified: 2026-08-28T16:17:39.390

Link: CVE-2026-33814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T03:15:13Z

Weaknesses