CVE-2026-33814

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835CWE-606

Affected software

VendorProductVersions
golang.org/x/netgolang.org/x/net/http2< 0.53.0
Go standard librarynet/http< 1.25.10; >= 1.26.0-0, < 1.26.3
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.22—
Red HatRed Hat OpenShift Container Platform 4.22—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red HatCluster Observability Operator 1.5.0—
Red Hatmulticluster engine for Kubernetes 2.11—
Red Hatmulticluster engine for Kubernetes 2.11—
Red HatOpenShift API for Data Protection 1.6—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—

References

Timeline

Published
May 7, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-338159.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338169.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338187.5Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-338199.8Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.CVE-2026-33825.5A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the CVE-2026-338219.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a networkCVE-2026-338226.1Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-338236.5Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.CVE-2026-338249.8Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.CVE-2026-338257.8Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.CVE-2026-338268.0Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.CVE-2026-338278.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacke