Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-33814

39
FAUCET Score

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

First published: May 7, 2026Last modified: May 8, 2026

Impacted Technologies

VendorProductVersion(s)CPE
< 1.25.10CPE matchmatch criteria
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
>= 1.26.0, < 1.26.3CPE matchmatch criteria
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
< 0.53.0CPE matchmatch criteria
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.78%
Probability of exploitation in next 30 days
EPSS Percentile
52.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0078 is in the 28th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (64)

microsoftpatch availablevia msrc
Product: 21299-17084Fixed in: 1.7.1-4
microsoftpatch availablevia msrc
Product: 21425-17084Fixed in: 1.4.0-2
microsoftpatch availablevia msrc
Product: azl3 golang 1.26.2-1 on Azure Linux 3.0Fixed in: 1.26.3-1
microsoftpatch availablevia msrc
Product: azl3 application-gateway-kubernetes-ingress 1.7.7-3 on Azure Linux 3.0Fixed in: 1.7.7-4
microsoftpatch availablevia msrc
Product: azl3 azurelinux-image-tools 1.2.0-2 on Azure Linux 3.0Fixed in: 1.3.0-2
microsoftpatch availablevia msrc
Product: azl3 containerd2 2.1.6-2 on Azure Linux 3.0Fixed in: 2.1.6-4
microsoftpatch availablevia msrc
Product: azl3 containerized-data-importer 1.62.0-3 on Azure Linux 3.0Fixed in: 1.62.0-4
microsoftpatch availablevia msrc
Product: azl3 etcd 3.5.28-1 on Azure Linux 3.0Fixed in: 3.5.30-2
microsoftpatch availablevia msrc
Product: azl3 etcd 3.5.30-2 on Azure Linux 3.0Fixed in: 3.5.30-2
microsoftpatch availablevia msrc
Product: azl3 ignition-flatcar 2.22.0-2 on Azure Linux 3.0Fixed in: 2.22.0-4
microsoftpatch availablevia msrc
Product: azl3 kata-containers 3.19.1.kata3-1 on Azure Linux 3.0Fixed in: 3.19.1.kata3-3
microsoftpatch availablevia msrc
Product: azl3 kata-containers-cc 3.15.0.aks0-9 on Azure Linux 3.0Fixed in: 3.15.0.aks0-11
microsoftpatch availablevia msrc
Product: azl3 kubevirt 1.7.1-2 on Azure Linux 3.0Fixed in: 1.7.1-4
microsoftpatch availablevia msrc
Product: azl3 packer 1.9.5-13 on Azure Linux 3.0Fixed in: 1.9.5-14
microsoftpatch availablevia msrc
Product: azl3 azurelinux-image-tools 1.4.0-2 on Azure Linux 3.0Fixed in: 1.4.0-2
microsoftpatch availablevia msrc
Product: azl3 kata-containers 3.19.1.kata3-4 on Azure Linux 3.0Fixed in: 3.19.1.kata3-4
microsoftpatch availablevia msrc
Product: azl3 packer 1.9.5-15 on Azure Linux 3.0Fixed in: 1.9.5-15
microsoftpatch availablevia msrc
Product: azl3 cert-manager 1.12.15-6 on Azure Linux 3.0Fixed in: 1.12.15-7
microsoftpatch availablevia msrc
Product: azl3 application-gateway-kubernetes-ingress 1.7.7-5 on Azure Linux 3.0Fixed in: 1.7.7-5
microsoftpatch availablevia msrc
Product: azl3 cert-manager 1.12.15-9 on Azure Linux 3.0Fixed in: 1.12.15-9
microsoftpatch availablevia msrc
Product: azl3 containerd2 2.2.4-2 on Azure Linux 3.0Fixed in: 2.2.4-2
microsoftpatch availablevia msrc
Product: azl3 containerized-data-importer 1.62.0-6 on Azure Linux 3.0Fixed in: 1.62.0-6
microsoftpatch availablevia msrc
Product: azl3 ignition-flatcar 2.22.0-5 on Azure Linux 3.0Fixed in: 2.22.0-5
microsoftpatch availablevia msrc
Product: azl3 kata-containers-cc 3.15.0.aks0-12 on Azure Linux 3.0Fixed in: 3.15.0.aks0-12
microsoftpatch availablevia msrc
Product: azl3 kubevirt 1.7.1-7 on Azure Linux 3.0Fixed in: 1.7.1-7
microsoftpatch availablevia msrc
Product: 21182-17084Fixed in: 3.5.30-2
microsoftpatch availablevia msrc
Product: 20966-17084Fixed in: 1.9.5-14
microsoftpatch availablevia msrc
Product: 20981-17084Fixed in: 1.7.7-4
microsoftpatch availablevia msrc
Product: 21177-17084Fixed in: 1.3.0-2
microsoftpatch availablevia msrc
Product: 21319-17084Fixed in: 2.1.6-4
microsoftpatch availablevia msrc
Product: 21427-17084Fixed in: 1.62.0-6
microsoftpatch availablevia msrc
Product: 21429-17084Fixed in: 2.22.0-5
microsoftpatch availablevia msrc
Product: 21397-17084Fixed in: 3.15.0.aks0-12
microsoftpatch availablevia msrc
Product: 21420-17084Fixed in: 1.7.1-7
microsoftpatch availablevia msrc
Product: 21284-17084Fixed in: 3.19.1.kata3-3
microsoftpatch availablevia msrc
Product: 21419-17084Fixed in: 3.19.1.kata3-4
microsoftpatch availablevia msrc
Product: 21383-17084Fixed in: 1.9.5-15
microsoftpatch availablevia msrc
Product: 20984-17084Fixed in: 1.12.15-7
microsoftpatch availablevia msrc
Product: 21424-17084Fixed in: 1.7.7-5
microsoftpatch availablevia msrc
Product: 21426-17084Fixed in: 1.12.15-9
microsoftpatch availablevia msrc
Product: 21407-17084Fixed in: 2.2.4-2
microsoftpatch availablevia msrc
Product: 21315-17084Fixed in: 2.22.0-4
microsoftpatch availablevia msrc
Product: 21252-17084Fixed in: 3.15.0.aks0-11
microsoftpatch availablevia msrc
Product: 21276-17084Fixed in: 1.62.0-4
microsoftpatch availablevia msrc
Product: 21428-17084Fixed in: 3.5.30-2
microsoftpatch availablevia msrc
Product: 21206-17084Fixed in: 1.26.3-1
ubuntupatch availablevia ubuntu_usn
Product: adsys (focal)Fixed in: 0.9.2~20.04.2ubuntu0.1+esm2
ubuntupatch availablevia ubuntu_usn
Product: adsys (jammy)Fixed in: 0.16.3~22.04.2ubuntu0.22.04.1
ubuntupatch availablevia ubuntu_usn
Product: adsys (noble)Fixed in: 0.16.3~24.04.2ubuntu0.24.04.1
ubuntupatch availablevia ubuntu_usn
Product: adsys (questing)Fixed in: 0.16.3ubuntu0.25.10.2
ubuntupatch availablevia ubuntu_usn
Product: adsys (resolute)Fixed in: 0.16.4ubuntu1.1
ubuntupatch availablevia ubuntu_usn
Product: containerd-app (resolute)Fixed in: 2.2.2-0ubuntu1.1
ubuntupatch availablevia ubuntu_usn
Product: containerd (bionic)Fixed in: 1.6.12-0ubuntu1~18.04.1+esm4
ubuntupatch availablevia ubuntu_usn
Product: containerd (focal)Fixed in: 1.6.12-0ubuntu1~20.04.8+esm2
ubuntupatch availablevia ubuntu_usn
Product: containerd (jammy)Fixed in: 1.6.12-0ubuntu1~22.04.11
ubuntupatch availablevia ubuntu_usn
Product: containerd (noble)Fixed in: 1.6.24~ds1-1ubuntu1.3+esm3
ubuntupatch availablevia ubuntu_usn
Product: containerd (resolute)Fixed in: 1.7.24~ds1-10ubuntu1+esm1
ubuntupatch availablevia ubuntu_usn
Product: containerd (xenial)Fixed in: 1.2.6-0ubuntu1~16.04.6+esm7
ubuntupatch availablevia ubuntu_usn
Product: containerd-stable (questing)Fixed in: 2.1.6-0ubuntu1~25.10.2
ubuntupatch availablevia ubuntu_usn
Product: containerd-stable (resolute)Fixed in: 2.2.2-0ubuntu1.1
ubuntupatch availablevia ubuntu_usn
Product: containerd-app (focal)Fixed in: 1.7.24-0ubuntu1~20.04.2+esm2
ubuntupatch availablevia ubuntu_usn
Product: containerd-app (jammy)Fixed in: 2.2.1-0ubuntu1~22.04.2
ubuntupatch availablevia ubuntu_usn
Product: containerd-app (noble)Fixed in: 2.2.1-0ubuntu1~24.04.3
ubuntupatch availablevia ubuntu_usn
Product: containerd-app (questing)Fixed in: 2.2.1-0ubuntu1~25.10.2

Vendor Advisories (5)

ubuntuUSN-8472-1

containerd vulnerabilities

Jun 25, 2026
ubuntuUSN-8471-1

containerd vulnerabilities

Jun 25, 2026
ubuntuUSN-8473-1

containerd vulnerabilities

Jun 25, 2026
ubuntuUSN-8430-1

ADSys vulnerabilities

Jun 15, 2026
microsoft2026-May/CVE-2026-33814Important

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

May 7, 2026

References

access.redhat.com / errata/RHSA-2026:23262
access.redhat.com / errata/RHSA-2026:23264
access.redhat.com / errata/RHSA-2026:33120
access.redhat.com / errata/RHSA-2026:33123
access.redhat.com / errata/RHSA-2026:33142
access.redhat.com / errata/RHSA-2026:33150
access.redhat.com / errata/RHSA-2026:34342
access.redhat.com / errata/RHSA-2026:37387
access.redhat.com / errata/RHSA-2026:42644
access.redhat.com / errata/RHSA-2026:43692
access.redhat.com / security/cve/CVE-2026-33814
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-33814.json
go.dev / cl/761581
Patch
go.dev / cl/761640
Patch
go.dev / issue/78476
Issue TrackingMailing List
groups.google.com / g/golang-announce/c/qcCIEXso47M
Release Notes
pkg.go.dev / vuln/GO-2026-4918
Vendor Advisory