golang.org/x/net: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net. GO-2026-4918, BIT-golang-2026-33814, CVE-2026-33814.
osv.devquote checked- security advisory
- Your code9 things to find
Nemotron fixes
In its own wordsmatches the page ✓
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
What Teire looks for in your code
- golang.org/x/net/http2.Transport.NewClientConn (go)
- golang.org/x/net/http2.Transport.RoundTrip (go)
- golang.org/x/net/http2.Transport.RoundTripOpt (go)
- golang.org/x/net/http2.clientConnPool.GetClientConn (go)
- golang.org/x/net/http2.clientConnReadLoop.processSettingsNoWrite (go)
- golang.org/x/net/http2.noDialClientConnPool.GetClientConn (go)
- golang.org/x/net/http2.noDialH2RoundTripper.NewClientConn (go)
- golang.org/x/net/http2.noDialH2RoundTripper.RoundTrip (go)
- golang.org/x/net/http2.unencryptedTransport.RoundTrip (go)
Does it reach your code?