CVE-2026-33814: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE in net/http/internal/http2 in golang.org/x/net
Other sources
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-golang-x-netto a version that resolves this vulnerability.Fixed in 1:0.56.0-1 - Compensating control
Mitigate by ensuring clients/servers do not send an HTTP/2 SETTINGS_MAX_FRAME_SIZE value of 0; block or reject HTTP/2 connections with SETTINGS_MAX_FRAME_SIZE=0 at a proxy/WAF/load balancer (or equivalent network control) to prevent the transport from entering the infinite loop.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33814?
CVE-2026-33814 is considered a critical vulnerability due to its potential to cause an infinite loop and service disruption.
How do I fix CVE-2026-33814?
To resolve CVE-2026-33814, update your Golang net/http/internal/http2 package to the latest version that addresses the infinite loop issue.
What can be exploited in CVE-2026-33814?
CVE-2026-33814 can be exploited by sending an HTTP/2 SETTINGS frame with a SETTINGS_MAX_FRAME_SIZE value of 0.
Which software is affected by CVE-2026-33814?
CVE-2026-33814 affects the golang.org/x/net package that implements HTTP/2 transport.
What are the implications of CVE-2026-33814 for my application?
Exploitation of CVE-2026-33814 may lead to application downtime due to an infinite loop created in the HTTP/2 transport handle.