CVE-2026-33814: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Published May 7, 2026
·
Updated

Infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE in net/http/internal/http2 in golang.org/x/net

Other sources

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0.

— MITRE

Affected Software

43 affected componentsFixes available
golang/golang.org/x/net
debian/golang-golang-x-net<=1:0.0+git20210119.5f4716e+dfsg-4, <=1:0.7.0+dfsg-1, <=1:0.27.0-2
1:0.56.0-1
Golang Go<1.25.10
Golang Go>=1.26.0<1.26.3
Golang Http2 Go<0.53.0
IBM Concert Software<=1.0-3.0.0
All of the following
azurelinux/kata-containers-cc<3.15.0.aks0-12
3.15.0.aks0-12
Microsoft Azure Linux=3.0
All of the following
azurelinux/ignition-flatcar<2.22.0-5
2.22.0-5
Microsoft Azure Linux=3.0
All of the following
azurelinux/etcd<3.5.30-2
3.5.30-2
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerd2<2.2.4-2
2.2.4-2
Microsoft Azure Linux=3.0
All of the following
azurelinux/application-gateway-kubernetes-ingress<1.7.7-5
1.7.7-5
Microsoft Azure Linux=3.0
All of the following
azurelinux/cert-manager<1.12.15-9
1.12.15-9
Microsoft Azure Linux=3.0
All of the following
azurelinux/packer<1.9.5-15
1.9.5-15
Microsoft Azure Linux=3.0
All of the following
azurelinux/azurelinux-image-tools<1.4.0-2
1.4.0-2
Microsoft Azure Linux=3.0
All of the following
azurelinux/kubevirt<1.7.1-7
1.7.1-7
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerized-data-importer<1.62.0-6
1.62.0-6
Microsoft Azure Linux=3.0
All of the following
azurelinux/kata-containers<3.19.1.kata3-4
3.19.1.kata3-4
Microsoft Azure Linux=3.0
All of the following
azurelinux/kata-containers<3.19.1.kata3-3
3.19.1.kata3-3
Microsoft Azure Linux=3.0
All of the following
azurelinux/kubevirt<1.7.1-4
1.7.1-4
Microsoft Azure Linux=3.0
All of the following
azurelinux/golang<1.26.3-1
1.26.3-1
Microsoft Azure Linux=3.0
All of the following
azurelinux/cert-manager<1.12.15-7
1.12.15-7
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerd2<2.1.6-4
2.1.6-4
Microsoft Azure Linux=3.0
All of the following
azurelinux/azurelinux-image-tools<1.3.0-2
1.3.0-2
Microsoft Azure Linux=3.0
alpine/go>=1.26.0<1.25.10-r0
1.25.10-r0
alpine/go>=1.26.0<1.26.3-r0
1.26.3-r0
alpine/rclone<1.74.1-r0
1.74.1-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/golang-golang-x-net to a version that resolves this vulnerability.

    Fixed in 1:0.56.0-1
  2. Upgrade

    Upgrade azurelinux/kata-containers-cc to a version that resolves this vulnerability.

    Fixed in 3.15.0.aks0-12
  3. Upgrade

    Upgrade azurelinux/ignition-flatcar to a version that resolves this vulnerability.

    Fixed in 2.22.0-5
  4. Upgrade

    Upgrade azurelinux/etcd to a version that resolves this vulnerability.

    Fixed in 3.5.30-2
  5. Upgrade

    Upgrade azurelinux/containerd2 to a version that resolves this vulnerability.

    Fixed in 2.2.4-2
  6. Upgrade

    Upgrade azurelinux/application-gateway-kubernetes-ingress to a version that resolves this vulnerability.

    Fixed in 1.7.7-5
  7. Upgrade

    Upgrade azurelinux/cert-manager to a version that resolves this vulnerability.

    Fixed in 1.12.15-9
  8. Upgrade

    Upgrade azurelinux/packer to a version that resolves this vulnerability.

    Fixed in 1.9.5-15
  9. Upgrade

    Upgrade azurelinux/azurelinux-image-tools to a version that resolves this vulnerability.

    Fixed in 1.4.0-2
  10. Upgrade

    Upgrade azurelinux/kubevirt to a version that resolves this vulnerability.

    Fixed in 1.7.1-7
  11. Upgrade

    Upgrade azurelinux/containerized-data-importer to a version that resolves this vulnerability.

    Fixed in 1.62.0-6
  12. Upgrade

    Upgrade azurelinux/kata-containers to a version that resolves this vulnerability.

    Fixed in 3.19.1.kata3-4
  13. Upgrade

    Upgrade azurelinux/packer to a version that resolves this vulnerability.

    Fixed in 1.9.5-14
  14. Upgrade

    Upgrade azurelinux/kata-containers to a version that resolves this vulnerability.

    Fixed in 3.19.1.kata3-3
  15. Upgrade

    Upgrade azurelinux/kubevirt to a version that resolves this vulnerability.

    Fixed in 1.7.1-4
  16. Upgrade

    Upgrade azurelinux/kata-containers-cc to a version that resolves this vulnerability.

    Fixed in 3.15.0.aks0-11
  17. Upgrade

    Upgrade azurelinux/golang to a version that resolves this vulnerability.

    Fixed in 1.26.3-1
  18. Upgrade

    Upgrade azurelinux/cert-manager to a version that resolves this vulnerability.

    Fixed in 1.12.15-7
  19. Upgrade

    Upgrade azurelinux/containerized-data-importer to a version that resolves this vulnerability.

    Fixed in 1.62.0-4
  20. Upgrade

    Upgrade azurelinux/containerd2 to a version that resolves this vulnerability.

    Fixed in 2.1.6-4
  21. Upgrade

    Upgrade azurelinux/azurelinux-image-tools to a version that resolves this vulnerability.

    Fixed in 1.3.0-2
  22. Upgrade

    Upgrade azurelinux/ignition-flatcar to a version that resolves this vulnerability.

    Fixed in 2.22.0-4
  23. Upgrade

    Upgrade azurelinux/application-gateway-kubernetes-ingress to a version that resolves this vulnerability.

    Fixed in 1.7.7-4
  24. Compensating control

    Mitigate by ensuring clients/servers do not send an HTTP/2 SETTINGS_MAX_FRAME_SIZE value of 0; block or reject HTTP/2 connections with SETTINGS_MAX_FRAME_SIZE=0 at a proxy/WAF/load balancer (or equivalent network control) to prevent the transport from entering the infinite loop.

Event History

May 7, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
DescriptionWeakness
Data Sourced
via OSV·07:41 PM
DescriptionSeverity
Data Sourced
via Red Hat·08:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·08:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·08:16 PM
Affected Software
May 10, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeaknessAffected Software
Oct 14, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2026-33814?

CVE-2026-33814 is considered a critical vulnerability due to its potential to cause an infinite loop and service disruption.

2

How do I fix CVE-2026-33814?

To resolve CVE-2026-33814, update your Golang net/http/internal/http2 package to the latest version that addresses the infinite loop issue.

3

What can be exploited in CVE-2026-33814?

CVE-2026-33814 can be exploited by sending an HTTP/2 SETTINGS frame with a SETTINGS_MAX_FRAME_SIZE value of 0.

4

Which software is affected by CVE-2026-33814?

CVE-2026-33814 affects the golang.org/x/net package that implements HTTP/2 transport.

5

What are the implications of CVE-2026-33814 for my application?

Exploitation of CVE-2026-33814 may lead to application downtime due to an infinite loop created in the HTTP/2 transport handle.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203