The vulnerability exists in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). When processing HTTP/2 SETTINGS frames, if a SETTINGS_MAX_FRAME_SIZE parameter is set to zero, the transport layer enters an infinite loop writing CONTINUATION frames. This loop causes resource exhaustion leading to a denial of service (DoS) condition. The flaw is categorized under CWE-835 (Loop with Unreachable Exit Condition) and CWE-606 (Unchecked Input for Loop Condition). The CVSS v3.1 base score is 7.5 (High), with network attack vector, low complexity, no privileges required, no user interaction, and high impact on availability only. Red Hat advisory states no mitigation currently meets their criteria for ease of use, applicability, or stability.

The vulnerability allows a remote, unauthenticated attacker to cause a denial of service by exhausting system resources through an infinite loop triggered by a malformed HTTP/2 SETTINGS frame. There is no impact on confidentiality or integrity. The availability of services using the affected Go HTTP/2 implementation can be disrupted.

According to the Red Hat advisory, no mitigation is currently available that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor vendor advisories for future patches or updates. Upgrading to a fixed version when available is recommended. Until then, no effective workaround is provided by the vendor.