BIT-golang-2026-33814Published
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-33814 · Microsoft / collected KEV context
cve-program · CVE-2026-33814
- https://go.dev/cl/761581
- https://go.dev/cl/761640
- https://go.dev/issue/78476
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4918
euvd · EUVD-2026-28420
- https://go.dev/cl/761581
- https://go.dev/cl/761640
- https://go.dev/issue/78476
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4918
nvd · CVE-2026-33814
- https://go.dev/cl/761581
- https://go.dev/cl/761640
- https://go.dev/issue/78476
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4918
- https://access.redhat.com/errata/RHSA-2026:22112
- https://access.redhat.com/errata/RHSA-2026:22120
- https://access.redhat.com/errata/RHSA-2026:22121
- https://access.redhat.com/errata/RHSA-2026:23262
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:33120
- https://access.redhat.com/errata/RHSA-2026:33123
- https://access.redhat.com/errata/RHSA-2026:33142
- https://access.redhat.com/errata/RHSA-2026:33150
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:49702
- https://access.redhat.com/errata/RHSA-2026:49712
- https://access.redhat.com/errata/RHSA-2026:50205
- https://access.redhat.com/errata/RHSA-2026:54274
- https://access.redhat.com/errata/RHSA-2026:54283
- https://access.redhat.com/errata/RHSA-2026:54284
- https://access.redhat.com/errata/RHSA-2026:54285
- https://access.redhat.com/errata/RHSA-2026:54286
- https://access.redhat.com/errata/RHSA-2026:54287
- https://access.redhat.com/errata/RHSA-2026:56854
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:57191
- https://access.redhat.com/errata/RHSA-2026:57194
- https://access.redhat.com/errata/RHSA-2026:57365
- https://access.redhat.com/errata/RHSA-2026:57367
- https://access.redhat.com/errata/RHSA-2026:57408
- https://access.redhat.com/errata/RHSA-2026:57545
- https://access.redhat.com/errata/RHSA-2026:57649
- https://access.redhat.com/errata/RHSA-2026:57845
- https://access.redhat.com/errata/RHSA-2026:59833
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/errata/RHSA-2026:60025
- https://access.redhat.com/errata/RHSA-2026:60441
- https://access.redhat.com/errata/RHSA-2026:60442
- https://access.redhat.com/errata/RHSA-2026:60446
- https://access.redhat.com/errata/RHSA-2026:60447
- https://access.redhat.com/errata/RHSA-2026:60454
- https://access.redhat.com/errata/RHSA-2026:60477
- https://access.redhat.com/errata/RHSA-2026:60478
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:60668
- https://access.redhat.com/errata/RHSA-2026:61253
- https://access.redhat.com/errata/RHSA-2026:62410
- https://access.redhat.com/errata/RHSA-2026:62550
- https://access.redhat.com/errata/RHSA-2026:62551
- https://access.redhat.com/errata/RHSA-2026:63046
- https://access.redhat.com/errata/RHSA-2026:63047
- https://access.redhat.com/errata/RHSA-2026:63048
- https://access.redhat.com/errata/RHSA-2026:63050
- https://access.redhat.com/errata/RHSA-2026:63091
- https://access.redhat.com/errata/RHSA-2026:63096
- https://access.redhat.com/errata/RHSA-2026:63097
- https://access.redhat.com/errata/RHSA-2026:63103
- https://access.redhat.com/errata/RHSA-2026:63104
- https://access.redhat.com/errata/RHSA-2026:63636
- https://access.redhat.com/errata/RHSA-2026:63637
- https://access.redhat.com/errata/RHSA-2026:63639
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66350
- https://access.redhat.com/security/cve/CVE-2026-33814
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json
osv · GO-2026-4918
Related operational evidence
Explicit CVE identifiers- When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. · Advisory content revised · 1 Nov 2026
- When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. · Advisory content revised · 30 Oct 2026