7.5
High
CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Description
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/net/http2 0.50 | 0.50.0 → < 0.51.0 | 0.51.0 |
References
- nvd.nist.gov nvd.nist.gov
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/net/http2
The 11 CVEs of golang.org/x/net/http2 →
CVE-2026-97032
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
7.5
High
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream…
9.1
Critical
CVE-2026-78669
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams…
7.5
High
CVE-2026-78660
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they…
7.5
High