This vulnerability occurs in the golang.org/x/net/http2 package when it processes HTTP/2 SETTINGS frames. Specifically, if the SETTINGS_MAX_FRAME_SIZE parameter is set to 0, the transport layer enters an infinite loop writing CONTINUATION frames because the exit condition for the loop is never met. This results in a denial of service condition by causing the affected process to hang indefinitely. No CVSS score or vendor advisory is currently available, and no patch links have been provided.

The impact is a denial of service condition caused by an infinite loop in the HTTP/2 transport implementation when receiving a SETTINGS_MAX_FRAME_SIZE value of 0. This could cause the affected application or service using golang.org/x/net/http2 to become unresponsive or consume excessive resources. There is no evidence of remote code execution or data leakage. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor golang.org/x/net project updates for patches addressing this issue. Until a fix is available, consider implementing input validation or filtering to prevent processing SETTINGS frames with SETTINGS_MAX_FRAME_SIZE set to 0 if feasible in the application context.