GO-2026-4559

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

En bref

Publiée: 2026-02-26 18:24 UTC
Mise à jour: 2026-05-15 10:59 UTC
CVE: CVE-2026-27141

Description

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Paquets affectés

Paquet	Versions
Go · golang.org/x/net	introduced 0.50.0, fixed 0.51.0

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-27141 ADVISORY
https://go.dev/cl/746180 FIX
https://go.dev/issue/77652 REPORT

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database