ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Published May 7, 2026 · updated Oct 15, 2026 · golang go

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 7, 2026 · OSV.dev

    Detected

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  2. Oct 15, 2026 · OSV.dev

    Fix available

    golang.org/x/net fixed in 0.53.0; stdlib fixed in 1.25.10

  3. Oct 15, 2026 · OSV.dev

    Fix available

    golang.org/x/net fixed in 0.53.0

  4. Oct 15, 2026 · OSV.dev

    Fix available

    stdlib fixed in 1.25.10

  5. Oct 15, 2026 · OSV.dev

    Updated

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected

  • Go golang.org/x/net0 → 0.53.0
  • Go stdlib0 → 1.25.10
  • cpe golang/goversion unspecified
  • cpe golang/http2version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33814

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-33814

    30-day exploitation probability 0.8%

    first.org
  • NIST NVDVulnerability recordCVE-2026-33814

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

    nvd.nist.gov
  • OSV.devPackage advisoryGO-2026-4918

    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

    osv.dev

References