CVE-2026-33814: 
Go vulnerability analysis and mitigation

CVE-2026-33814 is a Denial of Service vulnerability in Go's HTTP/2 transport implementation caused by an infinite loop when processing malformed SETTINGS frames. When the transport receives a SETTINGS_MAX_FRAME_SIZE value of 0, it enters an infinite loop continuously writing CONTINUATION frames, consuming CPU resources until the service becomes unavailable. Affected software includes the Go standard library (net/http) versions prior to 1.25.10 and 1.26.0–1.26.3, as well as the golang.org/x/net/http2 package prior to version 0.53.0. The vulnerability was published on May 7, 2026, with patches released on May 13, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (pkg.go.dev, ENISA EUVD).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). When Go's HTTP/2 transport processes a SETTINGS frame from a peer containing SETTINGS_MAX_FRAME_SIZE = 0, the transport logic enters an infinite loop attempting to write CONTINUATION frames, as the zero-byte frame size creates an exit condition that can never be reached. The attack vector is network-based, requires no authentication, no privileges, and no user interaction — an unauthenticated remote attacker simply needs to send a crafted HTTP/2 SETTINGS frame to a vulnerable server or client. Patches were applied via Go code review changes CL/761581 and CL/761640 (go.dev CL 761581, go.dev CL 761640, pkg.go.dev).

Successful exploitation causes the affected Go service to enter an infinite CPU-consuming loop, resulting in complete denial of service for the affected process. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any Go application using net/http or golang.org/x/net/http2 that accepts HTTP/2 connections from untrusted clients is at risk, including web servers, API gateways, proxies, and cloud-native services built with Go (ENISA EUVD, pkg.go.dev).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (ENISA EUVD). The EPSS score is approximately 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the low exploitation probability, the zero-precondition attack surface (unauthenticated, network-accessible) makes it straightforward to trigger once a target is identified.

1. Reconnaissance: Identify internet-facing services built with Go that expose HTTP/2 endpoints, using tools like Shodan, Censys, or nmap with HTTP/2 detection scripts. Confirm the target is running a vulnerable Go version (< 1.25.10, or 1.26.0–1.26.2) or golang.org/x/net/http2 < 0.53.0.
2. Craft malicious SETTINGS frame: Construct an HTTP/2 SETTINGS frame containing a SETTINGS_MAX_FRAME_SIZE parameter set to the value 0. This can be done using low-level HTTP/2 libraries (e.g., Python's h2 library or custom tooling).
3. Send the frame: Establish an HTTP/2 connection to the target server and transmit the crafted SETTINGS frame during the connection setup or mid-session.
4. Trigger infinite loop: The vulnerable transport processes the SETTINGS_MAX_FRAME_SIZE = 0 value and enters an infinite loop writing CONTINUATION frames, consuming 100% of a CPU core and rendering the service unresponsive.
5. Observe denial of service: The target service stops responding to legitimate requests; repeated or concurrent connections with the malicious frame can sustain the DoS condition (pkg.go.dev, go.dev CL 761581).

• Network: Unexpected HTTP/2 SETTINGS frames with SETTINGS_MAX_FRAME_SIZE = 0 from external clients; sustained high-volume CONTINUATION frame output from the affected server process.
• Process: Go service process consuming 100% of a CPU core with no corresponding increase in legitimate request throughput; process becomes unresponsive to health checks.
• Logs: Absence of normal request processing log entries during the incident window; potential goroutine leak or hang indicators in Go runtime diagnostics (/debug/pprof goroutine dumps showing stuck HTTP/2 transport goroutines).
• Metrics: Sudden spike in CPU utilization on the host running the Go service without a corresponding spike in handled requests; HTTP/2 connection counts remaining elevated while response rates drop to zero.

The Go team has released patched versions addressing this vulnerability: Go 1.25.10 (for the 1.25.x branch), Go 1.26.3 (for the 1.26.x branch), and golang.org/x/net/http2 v0.53.0. Organizations should upgrade their Go toolchain and rebuild affected binaries as the primary remediation. As a temporary workaround where immediate patching is not feasible, apply network segmentation or firewall rules to restrict access to HTTP/2 services from untrusted networks. Multiple Linux distributions including SUSE, openSUSE, Amazon Linux 2, and Amazon Linux 2023 have issued updated packages (pkg.go.dev, go.dev CL 761581, ENISA EUVD).

The Go security team disclosed the vulnerability via the golang-announce mailing list and published the advisory through the Go vulnerability database (golang-announce). The vulnerability was picked up by the oss-security mailing list and covered by security news aggregators. Multiple downstream projects including Portainer, Grafana k6, CircleCI Server, oauth2-proxy, etcd, and CloudNativePG issued patch releases referencing this CVE. The Yocto Project security list and several Linux distribution security teams (SUSE, openSUSE, Amazon Linux, Red Hat) issued advisories and updated packages within weeks of disclosure.