CVE-2026-27141 is a denial of service vulnerability in the golang.org/x/net/http2 package, affecting Red Hat Hardened Images. The vulnerability arises from a missing null pointer check when processing HTTP/2 frames of types 0x0a through 0x0f, which can cause the server to crash upon receiving specially crafted frames. This leads to a denial of service condition. Red Hat has acknowledged the issue and published an advisory but currently has no suitable mitigation or patch available that meets their deployment and stability standards. The vulnerability has a Red Hat CVSS v3 base score of 5.3, indicating a moderate impact, primarily availability loss. No known exploits in the wild have been reported.

The vulnerability can cause affected servers to crash and become unavailable, resulting in a denial of service condition. There is no impact on confidentiality or integrity reported. No known active exploitation has been observed. The issue affects availability of services relying on the vulnerable HTTP/2 implementation in golang.org/x/net/http2 within Red Hat Hardened Images.

Currently, Red Hat does not provide a mitigation or patch that meets their criteria for ease of use, applicability, or stability for this vulnerability. Users should monitor Red Hat advisories for updates or fixes. Consider limiting exposure of affected services to untrusted networks if possible until a fix is available. Customers with Red Hat Technical Account Managers (TAM) can review this CVE directly with their TAM for tailored guidance.