HTTP/2 Transport Vulnerability in Go Programming Language
CVE-2026-33814

Currently unrated

Key Information:

Vendor: Golang.org/x/net
Status: Golang.org/x/net/http2; Net/http
Vendor: CVE Published:; 7 May 2026

🔔 Create Golang.org/x/net Vulnerability Alert

What is CVE-2026-33814?

When the Go programming language processes HTTP/2 SETTINGS frames, it can enter an infinite loop if it receives a SETTINGS_MAX_FRAME_SIZE set to 0. This issue affects the transport layer, leading to a situation where CONTINUATION frames are repeatedly written without resolution, potentially impacting the performance and reliability of applications utilizing the HTTP/2 protocol.

Affected Version(s)

golang.org/x/net/http2 0 < 0.53.0

net/http 0 < 1.25.10

net/http 1.26.0-0 < 1.26.3

References

https://go.dev/cl/761581

https://go.dev/cl/761640

https://go.dev/issue/78476

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 7, 2026
Vulnerability Reserved
Mar 23, 2026

Credit

Marwan Atia (marwansamir688@gmail.com)

CVE-2026-33814 Data

JSON