CVE-2026-33814

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
References
Link Resource
https://go.dev/cl/761581 Patch
https://go.dev/cl/761640 Patch
https://go.dev/issue/78476 Issue Tracking Mailing List
https://groups.google.com/g/golang-announce/c/qcCIEXso47M Release Notes
https://pkg.go.dev/vuln/GO-2026-4918 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:22112
https://access.redhat.com/errata/RHSA-2026:22120
https://access.redhat.com/errata/RHSA-2026:22121
https://access.redhat.com/errata/RHSA-2026:23262
https://access.redhat.com/errata/RHSA-2026:23264
https://access.redhat.com/errata/RHSA-2026:33120
https://access.redhat.com/errata/RHSA-2026:33123
https://access.redhat.com/errata/RHSA-2026:33142
https://access.redhat.com/errata/RHSA-2026:33150
https://access.redhat.com/errata/RHSA-2026:34342
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:43692
https://access.redhat.com/errata/RHSA-2026:49702
https://access.redhat.com/errata/RHSA-2026:49712
https://access.redhat.com/errata/RHSA-2026:50205
https://access.redhat.com/errata/RHSA-2026:54274
https://access.redhat.com/errata/RHSA-2026:54283
https://access.redhat.com/errata/RHSA-2026:54284
https://access.redhat.com/errata/RHSA-2026:54285
https://access.redhat.com/errata/RHSA-2026:54286
https://access.redhat.com/errata/RHSA-2026:54287
https://access.redhat.com/errata/RHSA-2026:56854
https://access.redhat.com/errata/RHSA-2026:56912
https://access.redhat.com/errata/RHSA-2026:57191
https://access.redhat.com/errata/RHSA-2026:57194
https://access.redhat.com/errata/RHSA-2026:57365
https://access.redhat.com/errata/RHSA-2026:57367
https://access.redhat.com/errata/RHSA-2026:57408
https://access.redhat.com/errata/RHSA-2026:57545
https://access.redhat.com/errata/RHSA-2026:57649
https://access.redhat.com/errata/RHSA-2026:57845
https://access.redhat.com/errata/RHSA-2026:59833
https://access.redhat.com/errata/RHSA-2026:60023
https://access.redhat.com/errata/RHSA-2026:60025
https://access.redhat.com/errata/RHSA-2026:60441
https://access.redhat.com/errata/RHSA-2026:60442
https://access.redhat.com/errata/RHSA-2026:60446
https://access.redhat.com/errata/RHSA-2026:60447
https://access.redhat.com/errata/RHSA-2026:60454
https://access.redhat.com/errata/RHSA-2026:60477
https://access.redhat.com/errata/RHSA-2026:60478
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/errata/RHSA-2026:60668
https://access.redhat.com/errata/RHSA-2026:61253
https://access.redhat.com/errata/RHSA-2026:62410
https://access.redhat.com/errata/RHSA-2026:62550
https://access.redhat.com/errata/RHSA-2026:62551
https://access.redhat.com/errata/RHSA-2026:63046
https://access.redhat.com/errata/RHSA-2026:63047
https://access.redhat.com/errata/RHSA-2026:63048
https://access.redhat.com/errata/RHSA-2026:63050
https://access.redhat.com/errata/RHSA-2026:63091
https://access.redhat.com/errata/RHSA-2026:63096
https://access.redhat.com/errata/RHSA-2026:63097
https://access.redhat.com/errata/RHSA-2026:63103
https://access.redhat.com/errata/RHSA-2026:63104
https://access.redhat.com/errata/RHSA-2026:63636
https://access.redhat.com/errata/RHSA-2026:63637
https://access.redhat.com/errata/RHSA-2026:63639
https://access.redhat.com/errata/RHSA-2026:65126
https://access.redhat.com/errata/RHSA-2026:66350
https://access.redhat.com/security/cve/CVE-2026-33814
https://bugzilla.redhat.com/show_bug.cgi?id=2467815
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-05-07 20:16

Updated : 2026-09-16 13:17


NVD link : CVE-2026-33814

Mitre link : CVE-2026-33814

CVE.ORG link : CVE-2026-33814


JSON object : View

Products Affected

golang

  • go
  • http2
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-606

Unchecked Input for Loop Condition