golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames

🗓️ 10 Apr 2026 14:24:10Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Flaw in http2 package enables remote DoS via malformed frames; missing null check for 0x0a-0x0f.

Reporter	Title	Published	Views	Family All 282
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	12 Jun 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality (CVE-2026-41242, CVE-2026-4800) and denial of service (CVE-2026-27141)	21 May 202618:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in golang.org/x/net package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage	6 Jul 202616:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	15 May 202613:21	–	ibm
ATTACKERKB	CVE-2026-27141	26 Feb 202618:50	–	attackerkb
AlpineLinux	CVE-2026-27141	26 Feb 202618:50	–	alpinelinux
BDU FSTEC	The vulnerability of the net/http2 library in the Go programming language, which allows attackers to trigger a service failure	3 Apr 202600:00	–	bdu_fstec
CBLMariner	CVE-2026-27141 affecting package azurelinux-image-tools for versions less than 1.2.0-2	13 Mar 202619:01	–	cbl_mariner
CBLMariner	CVE-2026-27141 affecting package ignition-flatcar for versions less than 2.22.0-2	9 May 202603:31	–	cbl_mariner
Chainguard	CVE-2026-27141 vulnerabilities	3 Mar 202607:17	–	cgr

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	golang1.25	1.25.9-1.hum1	golang1.25-1.25.9-1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	golang1.25	1.25.9-1.hum1	golang1.25-1.25.9-1.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	golang1.25-docs	1.25.9-1.hum1	golang1.25-docs-1.25.9-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-27141
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/746180
go	www.go.dev/issue/77652
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27141
pkg	www.pkg.go.dev/vuln/GO-2026-4559
cve	www.cve.org/CVERecord

22 Jul 2026 06:59Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00501

SSVC

http2 package remote denial service malformed frames null check missing frame range 0x0a-0x0f