CVE-2026-27141 is a denial of service vulnerability in the golang.org/x/net/http2 package used by Red Hat Hardened Images and related products. The vulnerability arises from a missing null pointer check when processing specific HTTP/2 frame types (0x0a through 0x0f). A remote attacker can send specially crafted HTTP/2 frames to trigger a null pointer dereference, causing the server process to crash and become unavailable. Red Hat's advisory indicates no current mitigation meets their criteria, and a fix is not yet available. The vulnerability is tracked under Red Hat advisory RHSA-2026:7291 and is part of a broader update addressing multiple CVEs. The CVSS score assigned by Red Hat is 5.3 (medium severity), while other sources assign a higher score due to differing impact assessments.

The primary impact is a denial of service condition caused by a server crash due to null pointer dereference when processing malformed HTTP/2 frames. This results in service unavailability to legitimate users. There is no indication of confidentiality or integrity compromise. The vulnerability does not require privileges or user interaction to exploit. No known exploits are reported in the wild at this time.

Currently, no mitigation is available or meets Red Hat's criteria for ease of deployment and stability. Users are advised to monitor Red Hat advisories for updates and apply patches once released. Customers with Red Hat Technical Account Managers (TAM) can consult directly for guidance. Until a fix is available, consider limiting exposure of affected services to untrusted networks if feasible.