Net Http
Monthly
Remote denial of service in Go's HTTP/2 stack (both golang.org/x/net/http2 and the net/http standard library) allows an unauthenticated attacker to hang the server by sending an HTTP/2 SETTINGS frame carrying SETTINGS_MAX_FRAME_SIZE = 0, which drives the transport into an unbounded loop of writing CONTINUATION frames (CWE-835). It is network-reachable with no authentication or user interaction (CVSS 7.5, availability-only impact), publicly available exploit code exists, and the SSVC framework flags it as automatable; it is not listed in CISA KEV and EPSS is negligible (0.01%). Because net/http embeds this HTTP/2 code, any Go service serving HTTP/2 on a vulnerable release is affected until upgraded.
Remote denial of service in Go's HTTP/2 stack (both golang.org/x/net/http2 and the net/http standard library) allows an unauthenticated attacker to hang the server by sending an HTTP/2 SETTINGS frame carrying SETTINGS_MAX_FRAME_SIZE = 0, which drives the transport into an unbounded loop of writing CONTINUATION frames (CWE-835). It is network-reachable with no authentication or user interaction (CVSS 7.5, availability-only impact), publicly available exploit code exists, and the SSVC framework flags it as automatable; it is not listed in CISA KEV and EPSS is negligible (0.01%). Because net/http embeds this HTTP/2 code, any Go service serving HTTP/2 on a vulnerable release is affected until upgraded.