GO-2026-4559

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

At a glance

Published: 2026-02-26 18:24 UTC
Updated: 2026-05-15 10:59 UTC
CVE: CVE-2026-27141

Description

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Affected packages

Package	Versions
Go · golang.org/x/net	introduced 0.50.0, fixed 0.51.0

References

https://nvd.nist.gov/vuln/detail/CVE-2026-27141 ADVISORY
https://go.dev/cl/746180 FIX
https://go.dev/issue/77652 REPORT

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database