The vulnerability CVE-2026-33814 in golang.org/x/net/http2 arises when the HTTP/2 transport layer processes a SETTINGS frame containing SETTINGS_MAX_FRAME_SIZE with a value of zero. This triggers an infinite loop condition where the transport continuously writes CONTINUATION frames without exit, causing a denial of service due to resource exhaustion. The issue is categorized under CWE-835 (Loop with Unreachable Exit Condition) and CWE-606 (Unchecked Input for Loop Condition). The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. Vendor advisories from Red Hat reference this CVE in the context of their Cluster Observability Operator and related components, but explicit patch details are not provided in the input.

The vulnerability causes a denial of service by entering an infinite loop when processing a malformed HTTP/2 SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero. This leads to resource exhaustion and unavailability of the affected service. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official vendor advisories, such as Red Hat's security updates, for patches or workarounds addressing this issue. Until a fix is applied, avoid processing untrusted HTTP/2 SETTINGS frames with potentially invalid SETTINGS_MAX_FRAME_SIZE values if possible.