Fluid Attacks Database

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel10	golang	<0:1.26.3-4.el10_2	0:1.26.3-4.el10_2
rpm rhel9	golang	<0:1.26.3-1.el9_8	0:1.26.3-1.el9_8
rpm rhel9.6	golang	<0:1.26.5-1.el9_6	0:1.26.5-1.el9_6
debian 14	golang-golang-x-net	=1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| >=0 <1:0.53.0-1	1:0.53.0-1
go	golang.org/x/net	>=0 <0.53.0	0.53.0
rpm rhel9.6	skopeo	<2:1.18.1-6.el9_6.1	2:1.18.1-6.el9_6.1
debian 12	golang-golang-x-net	=1:0.10.0-1 \|\| =1:0.11.0-1 \|\| =1:0.14.0-1 \|\| =1:0.15.0-1 \|\| =1:0.15.0-2 \|\| =1:0.17.0+dfsg-1 \|\| =1:0.19.0+dfsg-1 \|\| =1:0.20.0+dfsg-1 \|\| =1:0.21.0+dfsg-1 \|\| =1:0.22.0+dfsg-1 \|\| =1:0.23.0+dfsg-1 \|\| =1:0.24.0+dfsg-1 \|\| =1:0.25.0+dfsg-1 \|\| =1:0.26.0+dfsg-1 \|\| =1:0.26.0+dfsg-2 \|\| =1:0.27.0-1 \|\| =1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1 \|\| =1:0.57.0-1 \|\| =1:0.58.0-1 \|\| =1:0.7.0+dfsg-1	-
go	stdlib	>=0 <1.25.10	1.25.10
debian 13	golang-golang-x-net	=1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1 \|\| =1:0.57.0-1 \|\| =1:0.58.0-1	-
rpm rhel8.6	go-toolset	<0:1.26.10-4.module+el8.6.0+25114+90ecdb41	0:1.26.10-4.module+el8.6.0+25114+90ecdb41

1-10 of 12

Aliases

1. CVE-2026-338142. NVD-2026-338143. OSV-2026-338144. OSV-DEBIAN-2026-338145. OSV-GO-2026-49186. GCVE-2026-338147. SECURITY-TRACKER-CVE-2026-33814

References

1. https://go.dev/cl/7615812. https://go.dev/cl/7616403. https://go.dev/issue/784764. https://groups.google.com/g/golang-announce/c/qcCIEXso47M

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.