GO-2026-4918

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-4918
Import Source
https://vuln.go.dev/ID/GO-2026-4918.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-4918
Aliases
Related
Published
2026-05-07T19:21:40Z
Modified
2026-05-11T08:11:05.383192409Z
Summary
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Details

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAME_SIZE with a value of 0.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-4918"
}
References
Credits
    • Marwan Atia (marwansamir688@gmail.com)

Affected packages

Go / golang.org/x/net

Package

Name
golang.org/x/net
View open source insights on deps.dev
Purl
pkg:golang/golang.org/x/net

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.53.0

Ecosystem specific 

{
    "imports": [
        {
            "symbols": [
                "Transport.NewClientConn",
                "Transport.RoundTrip",
                "Transport.RoundTripOpt",
                "clientConnPool.GetClientConn",
                "clientConnReadLoop.processSettingsNoWrite",
                "noDialClientConnPool.GetClientConn",
                "noDialH2RoundTripper.NewClientConn",
                "noDialH2RoundTripper.RoundTrip",
                "unencryptedTransport.RoundTrip"
            ],
            "path": "golang.org/x/net/http2"
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-4918.json"

Go / stdlib

Package

Name
stdlib
View open source insights on deps.dev
Purl
pkg:golang/stdlib

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.25.10
Introduced
1.26.0-0
Fixed
1.26.3

Ecosystem specific 

{
    "imports": [
        {
            "symbols": [
                "Client.CloseIdleConnections",
                "Client.Do",
                "Client.Get",
                "Client.Head",
                "Client.Post",
                "Client.PostForm",
                "ClientConn.Close",
                "ClientConn.RoundTrip",
                "Get",
                "Head",
                "Post",
                "PostForm",
                "Transport.CloseIdleConnections",
                "Transport.NewClientConn",
                "Transport.RoundTrip",
                "http1ClientConn.Close",
                "http1ClientConn.RoundTrip",
                "http2Transport.NewClientConn",
                "http2Transport.RoundTrip",
                "http2Transport.RoundTripOpt",
                "http2clientConnPool.GetClientConn",
                "http2clientConnReadLoop.processSettingsNoWrite",
                "http2noDialClientConnPool.GetClientConn",
                "http2noDialH2RoundTripper.NewClientConn",
                "http2noDialH2RoundTripper.RoundTrip",
                "http2unencryptedTransport.RoundTrip"
            ],
            "path": "net/http"
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-4918.json"