golang http2 vulnerabilities (CVE)

CVE records published for golang http2, newest first. Follow to get an email when a new one appears.

3 results

7.5High

CVE-2026-33814 6 months ago

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

golang.org/x/net golang.org/x/net/http2; Go standard library net/http; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

7.5High

CVE-2023-45288 2 years ago

HTTP/2 CONTINUATION flood in net/http

Go standard library net/http; golang.org/x/net golang.org/x/net/http2; go_standard_library net\/http; golang http2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

89%EPSS

7.5High

CVE-2023-44487 KEV 3 years ago

HTTP/2 Rapid Reset Attack Vulnerability

ietf http; Siemens RUGGEDCOM APE1808; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

100%EPSS