The golang.org/x/net/http2 package contains a vulnerability (CVE-2026-33814) classified as CWE-835 (Loop with Unreachable Exit Condition). When the HTTP/2 transport layer processes SETTINGS frames, if it receives a SETTINGS_MAX_FRAME_SIZE parameter with a value of 0, it enters an infinite loop writing CONTINUATION frames. This behavior can cause a denial of service by exhausting resources. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The affected version is explicitly stated as version 0 of the package. Multiple Red Hat advisories reference this CVE but do not explicitly confirm patch availability or remediation status.

An attacker can cause a denial of service by sending a SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to 0, triggering an infinite loop in the HTTP/2 transport implementation. This leads to resource exhaustion and unavailability of the affected service. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The multiple Red Hat advisories referencing this CVE do not explicitly state that a fix is available or provide remediation instructions. Users should monitor the official vendor advisories and apply any updates once released. Until then, consider mitigating exposure to untrusted HTTP/2 traffic or applying network-level controls to limit malformed SETTINGS frames.