Vulnerability GO-2026-4918
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 07, 2026 at 07:21 PM UTC
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
v0.1.0 - v0.52.0
v0.1.0 - v0.52.0
Summary
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Details
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
6 days ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
6 days ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
6 days ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<0.60.0 GO-2026-6603
<0.60.0 GO-2026-6603
Unknown
6 days ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Unknown
6 days ago
Root.Mkdir(All) can follow junctions out of the root on Windows in os
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
Impacted packages
Timeline
Published
5 months ago
May 07, 2026 at 07:21 PM UTC
Fixed (v0.53.0)
6 months ago
April 09, 2026 at 07:17 PM UTC
Last Modified
4 hours ago
October 15, 2026 at 10:41 AM UTC