CVE-2026-33814 PUBLISHED

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Assigner: Go
Reserved: 23.03.2026 Published: 07.05.2026 Updated: 07.05.2026

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Product Status

Vendor golang.org/x/net
Product golang.org/x/net/http2
Versions Default: unaffected
  • affected from 0 to 0.53.0 (excl.)
Vendor Go standard library
Product net/http
Versions Default: unaffected
  • affected from 0 to 1.25.10 (excl.)
  • affected from 1.26.0-0 to 1.26.3 (excl.)

Credits

  • Marwan Atia (marwansamir688@gmail.com)

References

Problem Types

  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')