CVE-2026-27141

Description

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.50%• Percentile: 42%

Techniques & Countermeasures

• CWE-476•NULL Pointer Dereference

  The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

• chainguard•amazon-ssm-agent

  < 3.3.3270.0-r8

• chainguard•amazon-ssm-agent-ecs-exec

  < 3.3.3270.0-r8

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 3.3.3270.0-r9

• chainguard•amazon-ssm-agent-fips

  < 3.3.3270.0-r9

• chainguard•apache-beam-java-11-sdk

  < 2.73.0-r1

• chainguard•apache-beam-java-17-sdk

  < 2.73.0-r1

• chainguard•apache-beam-java-21-sdk

  < 2.73.0-r1

• chainguard•apache-beam-python-3.11-sdk

  < 2.73.0-r1

• chainguard•apache-beam-python-3.12-sdk

  < 2.73.0-r1

• chainguard•apache-beam-python-3.13-sdk

  < 2.73.0-r1

• chainguard•apko

  < 1.1.12-r1

• chainguard•apko-fips

  < 1.1.12-r1

• chainguard•apm-server-8.19

  < 8.19.12-r1

• chainguard•apm-server-9.2

  < 9.2.6-r1

• chainguard•apm-server-9.3

  < 9.3.1-r1

• chainguard•apm-server-fips-8.19

  < 8.19.12-r1

• chainguard•apm-server-fips-9.2

  < 9.2.6-r1

• chainguard•apm-server-fips-9.3

  < 9.3.1-r1

• chainguard•aws-ebs-csi-driver-1.56

  < 1.56.0-r1

• chainguard•aws-ebs-csi-driver-fips-1.56

  < 1.56.0-r2

• chainguard•azure-service-operator

  < 2.18.0-r3

• chainguard•azure-service-operator-fips

  < 2.18.0-r2

• chainguard•bento

  < 1.16.0-r2

• chainguard•bento-fips

  < 1.16.0-r4 | < 1.16.0-r3

• chainguard•buf

  < 0

• chainguard•buildkite-agent

  < 3.118.1-r1

• chainguard•buildkite-agent-fips

  < 3.119.1-r1 | < 3.119.0-r0

• chainguard•caddy

  < 2.11.1-r2

• chainguard•caddy-fips

  < 2.11.1-r1

• chainguard•cert-manager-webhook-pdns

  < 2.5.5-r1

• chainguard•cert-manager-webhook-pdns-fips

  < 2.5.5-r1

• chainguard•cg

  < 0.2.219-r0

• chainguard•chainctl

  < 0.2.221-r1

• chainguard•chezmoi

  < 2.69.4-r2

• chainguard•chisel

  < 0

• chainguard•chisel-fips

  < 0

• chainguard•chrony_exporter

  < 0

• chainguard•chrony_exporter-fips

  < 0

• chainguard•cilium-cli

  < 0.19.2-r2

• chainguard•cloud-sql-proxy-2.21

  < 2.21.1-r1

• chainguard•cloud-sql-proxy-fips

  < 2.21.1-r1

• chainguard•cloudbeat-8.19

  < 8.19.12-r2

• chainguard•cloudbeat-9.3

  < 9.3.1-r2

• chainguard•cloudbeat-fips-8.19

  < 8.19.12-r1

• chainguard•cloudbeat-fips-9.3

  < 9.3.1-r2

• chainguard•cluster-api-azure-controller

  < 1.23.0-r1

• chainguard•cluster-api-azure-controller-fips

  < 1.23.0-r1

• chainguard•contour-1.31

  < 1.31.5-r1

• chainguard•contour-1.32

  < 1.32.4-r1

• chainguard•contour-1.33

  < 1.33.3-r1

Showing first 50 affected entries in server-rendered view.

References (4)

• https://nvd.nist.gov/vuln/detail/CVE-2026-27141
• https://go.dev/cl/746180
• https://go.dev/issue/77652
• https://pkg.go.dev/vuln/GO-2026-4559