Skip to content
fr Sign in
7.5 High

CVE-2026-33814 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it…

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected products and versions

Product Affected versions Fixed in
golang.org/x/net/http2 0.53 earliest → < 0.53.0 0.53.0
net/http 1.26 1.26.0-0 → < 1.26.3 1.26.3
net/http 1.25 earliest → < 1.25.10 1.25.10
Red Hat Hardened Images 1.26 earliest → < 1.26.4-2.hum1 1.26.4-2.hum1
Red Hat OpenShift Service Mesh 3.0 1782222607 earliest → < 1782222607 1782222607
Red Hat OpenShift Service Mesh 3.1 1782222451 earliest → < 1782222451 1782222451
Red Hat OpenShift Service Mesh 3.2 1782224541 earliest → < 1782224541 1782224541
Red Hat OpenShift Service Mesh 3.3 1782222038 earliest → < 1782222038 1782222038
Red Hat Enterprise Linux 10 Versions not published
Show the 107 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
OpenShift Service Mesh 2 Versions not published
Cluster Observability Operator 1.5.0 1782838476 earliest → < 1782838476 1782838476
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Service Mesh 3 1782222607 earliest → < 1782222607 1782222607
Red Hat Openshift Data Foundation 4.22 1782934284 earliest → < 1782934284 1782934284
Multicluster Engine for Kubernetes Versions not published
OpenShift API for Data Protection Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat OpenShift AI 2.25 1787330073 earliest → < 1787330073 1787330073
OpenShift API for Data Protection 1.6 1784058822 earliest → < 1784058822 1784058822
Assisted Installer for Red Hat OpenShift Container Platform 2 Versions not published
Builds for Red Hat OpenShift Versions not published
cert-manager Operator for Red Hat OpenShift Versions not published
Compliance Operator Versions not published
Confidential Compute Attestation Versions not published
Cryostat 4 Versions not published
Custom Metric Autoscaler operator for Red Hat Openshift Versions not published
Deployment Validation Operator Versions not published
External Secrets Operator for Red Hat OpenShift Versions not published
Fence Agents Remediation Operator Versions not published
File Integrity Operator Versions not published
Gatekeeper 3 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Logical Volume Manager Storage Versions not published
Machine Deletion Remediation Operator Versions not published
Migration Toolkit for Applications 8 Versions not published
Migration Toolkit for Containers Versions not published
Multiarch Tuning Operator Versions not published
Multicluster Global Hub Versions not published
Network Observability Operator Versions not published
Node HealthCheck Operator Versions not published
OpenShift Developer Tools and Services Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
OpenShift Service Mesh 3 Versions not published
Power monitoring for Red Hat OpenShift Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ceph Storage 5 Versions not published
Red Hat Ceph Storage 6 Versions not published
Red Hat Ceph Storage 7 Versions not published
Red Hat Ceph Storage 8 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Certification Program for Red Hat Enterprise Linux 9 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Lightspeed for Runtimes Operator Versions not published
Red Hat OpenShift Cluster Manager CLI Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift Dev Workspaces Operator Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift on AWS Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Service Interconnect 2 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Web Terminal Versions not published
Secrets Management Console for Red Hat OpenShift Versions not published
Security Profiles Operator Versions not published
Zero Trust Workload Identity Manager Versions not published
Zero Trust Workload Identity Manager - Tech Preview Versions not published
Red Hat OpenShift distributed tracing 3.10.1 1785704547 earliest → < 1785704547 1785704547
Red Hat OpenShift distributed tracing 3.10.2 1785704547 earliest → < 1785704547 1785704547
Node Maintenance Operator Versions not published
Self Node Remediation Operator Versions not published
Storage-Based Remediation Versions not published
Red Hat OpenShift Workload Availability 0.12 1785202723 earliest → < 1785202723 1785202723
Red Hat OpenShift Workload Availability 0.7 1785203508 earliest → < 1785203508 1785203508
Red Hat OpenShift Workload Availability 5.7 1785202847 earliest → < 1785202847 1785202847
Red Hat OpenShift Workload Availability 0.13 1785203036 earliest → < 1785203036 1785203036
Red Hat OpenShift Workload Availability 0.3 1785203474 earliest → < 1785203474 1785203474
Red Hat OpenShift Workload Availability 0.8 1785203079 earliest → < 1785203079 1785203079
Red Hat OpenShift distributed tracing 3.10.0 1785704547 earliest → < 1785704547 1785704547
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat OpenShift Container Platform 4.16 1788154324 earliest → < 1788154324 1788154324
multicluster engine for Kubernetes 2.11 1786912006 earliest → < 1786912006 1786912006
Red Hat Advanced Cluster Management for Kubernetes 2.16 1786908301 earliest → < 1786908301 1786908301
Red Hat OpenShift AI 3.4 1787562200 earliest → < 1787562200 1787562200
Red Hat OpenShift Container Platform 4.15 1787056066 earliest → < 1787056066 1787056066
Red Hat OpenShift Container Platform 4.19 1788310540 earliest → < 1788310540 1788310540
Red Hat OpenShift Container Platform 4.20 1788349570 earliest → < 1788349570 1788349570
Red Hat OpenShift Container Platform 4.22 1788313988 earliest → < 1788313988 1788313988
ExternalDNS Operator Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Cluster Observability Operator 1.5.2 1782838476 earliest → < 1782838476 1782838476
Red Hat OpenShift Container Platform 4.21 1788274951 earliest → < 1788274951 1788274951
Red Hat OpenShift Container Platform 4.12 1786752176 earliest → < 1786752176 1786752176
Red Hat OpenShift Container Platform 4.17 1787548114 earliest → < 1787548114 1787548114
Red Hat OpenShift Container Platform 4.2 1787757917 earliest → < 1787757917 1787757917
Red Hat OpenShift Container Platform 4.14 1788219427 earliest → < 1788219427 1788219427

References

Timeline

  1. Published
  2. Last modified

Other CVEs of golang.org/x/net/http2

The 11 CVEs of golang.org/x/net/http2 →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 High CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they… 7.5 High
Track this CVE