CVE-2026-27141: Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

Deferred

AliasesUBUNTU-CVE-2026-27141CGA-226v-8pxp-2p5qCGA-22fx-c7w7-7frm+830 more

Published 26-02-2026Last modified 27-02-2026

Vulnerability summary

CVE-2026-27141 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in golang.org/x/net golang.org/x/net/http2. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.57%

0%100%

Low · -0.09 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 9

MGASA-2026-0147 OPENSUSE-SU-2026:10313-1 OPENSUSE-SU-2026:10385-1 OPENSUSE-SU-2026:21436-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:7291+4 more

Timeline

26-02-2026
PublishedVulnerability first disclosed.
27-02-2026
Last modifiedVulnerability information updated.

Description

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

Decrease -0.09 pp

From 0.65% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

amazon-ssm-agent< 3.3.3270.0-r8
amazon-ssm-agent-ecs-exec< 3.3.3270.0-r8
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r9
amazon-ssm-agent-fips< 3.3.3270.0-r9
apache-beam-java-11-sdk< 2.73.0-r1

apache-beam-java-17-sdk< 2.73.0-r1
apache-beam-java-21-sdk< 2.73.0-r1
apache-beam-python-3.11-sdk< 2.73.0-r1
apache-beam-python-3.12-sdk< 2.73.0-r1
apache-beam-python-3.13-sdk< 2.73.0-r1
apko< 1.1.12-r1
apko-fips< 1.1.12-r1
apm-server-8.19< 8.19.12-r1
apm-server-9.2< 9.2.6-r1
apm-server-9.3< 9.3.1-r1
apm-server-fips-8.19< 8.19.12-r1
apm-server-fips-9.2< 9.2.6-r1
apm-server-fips-9.3< 9.3.1-r1
aws-ebs-csi-driver-1.56< 1.56.0-r1
aws-ebs-csi-driver-fips-1.56< 1.56.0-r2
azure-service-operator< 2.18.0-r3
azure-service-operator-fips< 2.18.0-r2
bento< 1.16.0-r2
bento-fips< 1.16.0-r4 | < 1.16.0-r3
bufAll versions (No fix recorded)
buildkite-agent< 3.118.1-r1
buildkite-agent-fips< 3.119.1-r1 | < 3.119.0-r0
caddy< 2.11.1-r2
caddy-fips< 2.11.1-r1
cert-manager-webhook-pdns< 2.5.5-r1
cert-manager-webhook-pdns-fips< 2.5.5-r1
cg< 0.2.219-r0
chainctl< 0.2.221-r1
chezmoi< 2.69.4-r2
chiselAll versions (No fix recorded)
chisel-fipsAll versions (No fix recorded)
chrony_exporterAll versions (No fix recorded)
chrony_exporter-fipsAll versions (No fix recorded)
cilium-cli< 0.19.2-r2
cloud-sql-proxy-2.21< 2.21.1-r1
cloud-sql-proxy-fips< 2.21.1-r1
cloudbeat-8.19< 8.19.12-r2
cloudbeat-9.3< 9.3.1-r2
cloudbeat-fips-8.19< 8.19.12-r1
cloudbeat-fips-9.3< 9.3.1-r2
cluster-api-azure-controller< 1.23.0-r1
cluster-api-azure-controller-fips< 1.23.0-r1
contour-1.31< 1.31.5-r1
contour-1.32< 1.32.4-r1
contour-1.33< 1.33.3-r1
contour-fips-1.31< 1.31.5-r1
contour-fips-1.32< 1.32.4-r1
contour-fips-1.33< 1.33.3-r1
crossplane-provider-aws-acm< 2.5.0-r2
crossplane-provider-aws-acm-fips< 2.5.0-r1
crossplane-provider-aws-backup< 2.5.0-r1
crossplane-provider-aws-backup-fips< 2.5.0-r1
crossplane-provider-aws-cloudformation< 2.5.0-r1
crossplane-provider-aws-cloudformation-fips< 2.5.0-r2
crossplane-provider-aws-cloudfront< 2.5.0-r1
crossplane-provider-aws-cloudfront-fips< 2.5.0-r2
crossplane-provider-aws-cloudwatchlogs< 2.5.0-r1
crossplane-provider-aws-cloudwatchlogs-fips< 2.5.0-r2
crossplane-provider-aws-cognitoidentity< 2.5.0-r1
crossplane-provider-aws-cognitoidentity-fips< 2.5.0-r1
crossplane-provider-aws-cognitoidp< 2.5.0-r1
crossplane-provider-aws-cognitoidp-fips< 2.5.0-r1
crossplane-provider-aws-dynamodb< 2.5.0-r1
crossplane-provider-aws-dynamodb-fips< 2.5.0-r2
crossplane-provider-aws-ec2< 2.5.0-r1
crossplane-provider-aws-ec2-fips< 2.5.0-r2
crossplane-provider-aws-ecr< 2.5.0-r1
crossplane-provider-aws-ecr-fips< 2.5.0-r1
crossplane-provider-aws-ecs< 2.5.0-r1
crossplane-provider-aws-ecs-fips< 2.5.0-r1
crossplane-provider-aws-efs< 2.5.0-r1
crossplane-provider-aws-efs-fips< 2.5.0-r1
crossplane-provider-aws-eks< 2.5.0-r1
crossplane-provider-aws-eks-fips< 2.5.0-r2
crossplane-provider-aws-elasticache< 2.5.0-r1
crossplane-provider-aws-elasticache-fips< 2.5.0-r2
crossplane-provider-aws-firehose< 2.5.0-r1
crossplane-provider-aws-firehose-fips< 2.5.0-r2
crossplane-provider-aws-iam< 2.5.0-r1
crossplane-provider-aws-iam-fips< 2.5.0-r2
crossplane-provider-aws-kinesis< 2.5.0-r1
crossplane-provider-aws-kinesis-fips< 2.5.0-r2
crossplane-provider-aws-kms< 2.5.0-r1
crossplane-provider-aws-kms-fips< 2.5.0-r2
crossplane-provider-aws-lambda< 2.5.0-r1
crossplane-provider-aws-lambda-fips< 2.5.0-r2
crossplane-provider-aws-memorydb< 2.5.0-r1
crossplane-provider-aws-memorydb-fips< 2.5.0-r2
crossplane-provider-aws-rds< 2.5.0-r1
crossplane-provider-aws-rds-fips< 2.5.0-r2
crossplane-provider-aws-rolesanywhere< 2.5.0-r1
crossplane-provider-aws-rolesanywhere-fips< 2.5.0-r1
crossplane-provider-aws-route53< 2.5.0-r1
crossplane-provider-aws-route53-fips< 2.5.0-r2
crossplane-provider-aws-s3< 2.5.0-r1
crossplane-provider-aws-s3-fips< 2.5.0-r2
crossplane-provider-aws-servicediscovery< 2.5.0-r1
crossplane-provider-aws-servicediscovery-fips< 2.5.0-r1
crossplane-provider-aws-sns< 2.5.0-r1
crossplane-provider-aws-sns-fips< 2.5.0-r2
crossplane-provider-aws-sqs< 2.5.0-r1
crossplane-provider-aws-sqs-fips< 2.5.0-r2
crossplane-provider-aws-ssm< 2.5.0-r1
crossplane-provider-aws-ssm-fips< 2.5.0-r2
crossplane-provider-aws-wafv2< 2.5.0-r1
crossplane-provider-aws-wafv2-fips< 2.5.0-r1
crossplane-provider-family-aws< 2.5.0-r1
crossplane-provider-family-aws-fips< 2.5.0-r2
crossplane-provider-terraform< 1.1.1-r1
crossplane-provider-terraform-fips< 1.1.1-r1
cueAll versions (No fix recorded)
cue-fipsAll versions (No fix recorded)
datadog-agent-7.71< 7.71.2-r16
datadog-agent-7.72< 7.72.4-r16
datadog-agent-7.73< 7.73.3-r8
datadog-agent-7.74< 7.74.1-r10
datadog-agent-7.77< 7.77.3-r1
datadog-agent-fips-7.71< 7.71.2-r10
datadog-agent-fips-7.73< 7.73.3-r6
datadog-agent-fips-7.77< 7.77.3-r1
datadog-cluster-agent-7.71< 7.71.2-r16
datadog-cluster-agent-7.72< 7.72.4-r16
datadog-cluster-agent-7.73< 7.73.3-r8
datadog-cluster-agent-7.74< 7.74.1-r10
datadog-cluster-agent-7.77< 7.77.3-r1
datadog-cluster-agent-fips-7.71< 7.71.2-r10
datadog-cluster-agent-fips-7.73< 7.73.3-r6
datadog-cluster-agent-fips-7.77< 7.77.3-r1
datadog-operator< 1.26.0-r1 | All versions (No fix recorded)
datadog-operator-fipsAll versions (No fix recorded) | < 1.26.0-r1
deck< 1.57.0-r1
deck-fips< 1.57.0-r1
descheduler< 0.35.1-r1
descheduler-fips< 0.35.1-r1
dex< 2.45.1-r1
dex-fips< 2.45.0-r1
dockerizeAll versions (No fix recorded)
dockerize-fipsAll versions (No fix recorded)
dogstatsd-7.71< 7.71.2-r16
dogstatsd-7.72< 7.72.4-r16
dogstatsd-7.73< 7.73.3-r8
dogstatsd-7.74< 7.74.1-r10
dogstatsd-7.77< 7.77.3-r1
emissary< 4.0.1-r1
emissary-apiext< 4.0.1-r1
external-dns-0.20< 0.20.0-r11
external-dns-fips-0.20< 0.20.0-r10
fleet-server-8.19< 8.19.12-r1
fleet-server-9.2< 9.2.6-r1
fleet-server-9.3< 9.3.1-r1
fleet-server-fips-8.19< 8.19.12-r1
fleet-server-fips-9.2< 9.2.6-r1
fleet-server-fips-9.3< 9.3.1-r1
flux-2.8< 2.8.1-r3
flux-fips-2.8< 2.8.1-r2
flux-kustomize-controller< 1.8.1-r1
flux-kustomize-controller-fips< 1.8.1-r2
flux-operator< 0.43.0-r2
flux-operator-fips< 0.43.0-r0
flux-operator-mcp< 0.43.0-r2
flux-operator-mcp-fips< 0.43.0-r0
flux-source-watcher< 2.1.0-r1
flux-source-watcher-fips< 2.1.0-r1
gitlab-pages-18.11< 18.11.2-r2
gitlab-pages-fips-18.11< 18.11.2-r1
gitlab-runner-18.10< 18.10.1-r1
gitlab-runner-fips-18.10< 18.10.1-r1
gitlab-runner-helper-18.10< 18.10.1-r1
gitlab-runner-helper-fips-18.10< 18.10.1-r1
gitlab-shell-18.11< 18.11.2-r1
gitlab-shell-fips-18.11< 18.11.2-r1
goose< 3.27.0-r1
goose-fips< 3.27.0-r1
goreleaser< 2.14.1-r2
gotenberg< 8.27.0-r1
gpu-operator-26.3< 26.3.1-r1
gpu-operator-26.3-validator< 26.3.1-r1
gpu-operator-fips-26.3< 26.3.1-r1
gpu-operator-fips-26.3-validator< 26.3.1-r1
grafana-alloy< 1.14.0-r1
grafana-alloy-fips< 1.14.0-r1
grafana-mimir-2.17< 2.17.10-r1
grafana-mimir-2.17-metaconvert-2.17< 2.17.10-r1
grafana-mimir-2.17-mimirtool-2.17< 2.17.10-r1
grafana-mimir-2.17-query-tee-2.17< 2.17.10-r1
grafana-mimir-3.0< 3.0.6-r1
grafana-mimir-3.0-metaconvert-3.0< 3.0.6-r1
grafana-mimir-3.0-mimirtool-3.0< 3.0.6-r1
grafana-mimir-3.0-query-tee-3.0< 3.0.6-r1
grafana-mimir-fips-2.17< 2.17.10-r1
grafana-mimir-fips-3.0< 3.0.6-r1
harbor-2.11All versions (No fix recorded)
harbor-2.11-exporterAll versions (No fix recorded)
harbor-2.11-jobserviceAll versions (No fix recorded)

Show all 199

Alpine1 product

rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 552

References

10 links

nvd.nist.gov/vuln/detail/CVE-2026-27141REPORTAdvisoryOval
go.dev/cl/746180REPORTFIX
go.dev/issue/77652REPORT
pkg.go.dev/vuln/GO-2026-4559REPORT
ubuntu.com/security/CVE-2026-27141REPORT
www.cve.org/CVERecord?id=CVE-2026-27141REPORT
github.com/golang/go/issues/77652REPORT
ubuntu.com/security/notices/USN-8430-1Advisory
www.suse.com/security/cve/CVE-2026-27141WEB
security.alpinelinux.org/vuln/CVE-2026-27141Advisory