Golang Http2 vulnerabilities

• go standard library net/http, golang go, http2 +106 more +108 more Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net CVE-2026-33814 Fix available 7.5 HighMay 7, 2026
• go standard library net/http, net\/http, golang http2 +1 more +3 more HTTP/2 CONTINUATION flood in net/http CVE-2023-45288 Public exploitFix available EPSS 89.5% 7.5 HighMarch 27, 2024
• go standard library net/http, golang go, http2 +4 more +6 more HTTP/2 rapid reset can cause excessive work in net/http CVE-2023-39325 Public exploitFix available 7.5 HighOctober 11, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• go standard library net/http, golang go, hpack +3 more +5 more Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net CVE-2022-41723 Fix available 7.5 HighFebruary 16, 2023
• go standard library net/http, golang go, http2 +2 more +4 more Excessive memory growth in net/http and golang.org/x/net/http2 CVE-2022-41717 Public exploitFix available 5.3 MediumDecember 8, 2022