CVE-2026-33814

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.02%• Percentile: 5%

Techniques & Countermeasures

• CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

• go standard library•net/http

  < 1.25.10 | ≥ 1.26.0-0, < 1.26.3

• golang•go

  < 1.25.10 | ≥ 1.26.0, < 1.26.3

• golang.org/x•net

  < 0.53.0

• golang•http2

  < 0.53.0

• Go•stdlib

  ≥ 1.26.0-0, < 1.26.3

• golang.org/x/net•golang.org/x/net/http2

  < 0.53.0

References (5)

• https://go.dev/cl/761581
• https://go.dev/cl/761640
• https://go.dev/issue/78476
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4918