Go net/http2 CVE-2026-33814

Vendor-released patch: upgrade golang.org/x/net/http2 to 0.53.0 or later, and rebuild Go binaries with Go 1.25.10 / 1.26.3 or later for the net/http standard-library path; then redeploy all affected services (the fix is in the compiled binary, so a dependency bump plus recompile is required, not just a runtime config change). The upstream changes are in the Go CLs https://go.dev/cl/761581 and https://go.dev/cl/761640 (issue https://go.dev/issue/78476), and OS-package users should apply Red Hat RHSA-2026:23262/23264/33120/33123/33142/33150 or Ubuntu USN-8430-1 as applicable. If immediate patching is not possible, the practical compensating control is to disable HTTP/2 on affected front ends or terminate TLS/HTTP2 at a non-vulnerable reverse proxy or load balancer that rejects malformed SETTINGS frames - the trade-off is loss of HTTP/2 multiplexing and performance for clients until the fix is deployed. Rate-limiting or dropping connections from sources that trigger the loop offers only partial, reactive protection since a single crafted frame is sufficient.