The vulnerability exists in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). When processing HTTP/2 SETTINGS frames, if a SETTINGS_MAX_FRAME_SIZE parameter is received with a value of zero, the transport layer enters an infinite loop writing CONTINUATION frames. This loop causes resource exhaustion leading to a denial of service condition. The flaw is tracked as CWE-835 (Loop with Unreachable Exit Condition) and CWE-606 (Unchecked Input for Loop Condition). The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, and no user interaction. Red Hat's advisory confirms the vulnerability and states that no mitigation or fix meeting their criteria is currently available.

A remote, unauthenticated attacker can cause a denial of service by sending a malformed HTTP/2 SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero. This triggers an infinite loop in the Go HTTP/2 transport layer, exhausting system resources and impacting service availability. There is no impact on confidentiality or integrity.

According to the Red Hat advisory, no mitigation or official fix meeting their criteria for ease of use, deployment, and stability is currently available. Users should monitor vendor advisories for updates and consider upgrading to fixed versions once available. No temporary workarounds are provided.