Loading story…
Maintainers disclosed two high-severity HTTP/2 denial-of-service flaws that can be triggered by malicious protocol frames in widely used implementations. In nghttp2, CVE-2026-27135 causes an assertion failure after session termination has begun if the library continues processing incoming data and encounters a malformed frame that leads to FRAME_SIZE_ERROR. The vulnerable paths include ALTSVC, PRIORITY_UPDATE, and user-defined extension frames, with the issue fixed in nghttp2 v1.68.1 by adding missing internal state validation; no workaround was provided.
In Go's HTTP/2 transport, CVE-2026-33814 allows a malicious server to force an infinite loop of CONTINUATION frame writes by sending a SETTINGS frame with SETTINGS_MAX_FRAME_SIZE=0, creating a remote denial-of-service condition against HTTP/2 clients. The flaw, tracked as Go issue #78476 and later documented by Microsoft with a CVSS 7.5 rating, was fixed by validating received SETTINGS_MAX_FRAME_SIZE values before use, underscoring continued risk from improper state and bounds checking in HTTP/2 frame handling.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published an advisory for CVE-2026-33814, describing an infinite-loop denial-of-service vulnerability in golang.org/x/net's HTTP/2 transport caused by an invalid SETTINGS_MAX_FRAME_SIZE value. The advisory rated the issue 7.5 CVSS and listed the release date as May 10, 2026.
Red Hat released advisories for CVE-2026-27135 affecting nghttp2 and Node.js-related packages across Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, RHEL 10.0 EUS, and JBoss Core Services. The earliest fixes listed were RHSA-2026:7080 for RHEL 10 nodejs22 and RHSA-2026:7123 for RHEL 8 nodejs:22 on April 8, 2026.
Go issue 78476 was opened to track CVE-2026-33814, a denial-of-service vulnerability in net/http/internal/http2 where a malicious SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to 0 can trigger an infinite loop of CONTINUATION frame writes. The report credits Marwan Atia and notes the flaw was fixed by validating received SETTINGS_MAX_FRAME_SIZE values.
The nghttp2 project fixed CVE-2026-27135 in version 1.68.1 by adding state validation to the affected code paths. The advisory stated there is no workaround and recommended patching even if asserts are disabled at build time.
A security advisory disclosed CVE-2026-27135 in nghttp2, a high-severity denial-of-service issue caused by missing internal state validation after session termination begins. The flaw can lead to an assertion failure when malformed frames are processed after termination is initiated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcemsrc.microsoft.com
Open sourcego.dev
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go fixed **CVE-2022-27664**, a denial-of-service vulnerability in the HTTP/2 server implementation used by `net/http`. A remote client could cause a server connection to hang indefinitely when a fatal error interrupted clean shutdown after the server had sent a `GOAWAY` frame, potentially exhausting server resources through repeated connections. The fix updated the bundled `golang.org/x/net/http2` code and was backported to supported Go 1.18 and 1.19 release branches, including the Go 1.18.6 and 1.19.1 security releases. Go 1.17 did not receive a backport under the project’s release policy; organizations operating affected or unsupported Go versions should upgrade to a supported patched release and assess internet-facing HTTP/2 services for exposure.
Aug 27, 2026
CERT/CC disclosed **VU#885548**, a denial-of-service condition in some HTTP/2 server implementations that can be triggered remotely without authentication by abusing stalled flow-control behavior. An attacker can advertise settings such as `SETTINGS_INITIAL_WINDOW_SIZE = 0` or stop sending `WINDOW_UPDATE` frames, forcing servers to buffer large response bodies in memory across many concurrent streams. The resulting impact can include memory exhaustion, swap thrashing, worker or connection exhaustion, service instability, and in severe cases a full crash. Okta Red Team was credited with reporting the issue, and the advisory linked the problem to **`CVE-2026-59762`**, **`CVE-2026-59173`**, and **`CVE-2026-44909`**. F5 said **`CVE-2026-59762`** affects **BIG-IP** and related **BIG-IP Next** products when an HTTP/2 profile is configured on a virtual server, allowing crafted requests to drive up memory use in the **TMM** process until performance degrades or TMM restarts; the company rated the flaw **CVSS 7.5** under v3.1 and **8.7** under v4.0 and urged customers to install patched releases. Apache also confirmed **`CVE-2026-59173`** in **Apache Traffic Server** versions **9.0.0 through 9.2.13** and **10.0.0 through 10.1.2**, recommending upgrades to **9.2.14+** or **10.1.3+**. CERT noted that several vendors have already issued fixes, while some products including GNU wget, Go, HAProxy, ISC BIND, lighttpd, and nghttp2 were listed as not affected.
Jul 17, 2026
A high-severity flaw tracked as **CVE-2026-33186** allows attackers to bypass path-based authorization in **gRPC-Go** by sending malformed HTTP/2 requests whose `:path` pseudo-header omits the required leading slash. In affected versions before **1.79.3**, the server still routed requests correctly, but authorization components evaluated the non-canonical path value, creating a mismatch that let canonical deny rules fail. The issue affects deployments using **`google.golang.org/grpc/authz`** RBAC as well as custom interceptors that rely on **`info.FullMethod`** or **`grpc.Method(ctx)`** while otherwise permitting requests by default. Reports say the flaw can also impact products and middleware built on gRPC-Go, including **Traefik** custom middleware, where policies written for paths such as `/InternalService/SensitiveMethod` could be bypassed with malformed variants like `InternalService/SensitiveMethod`. Exploitation requires the ability to send raw HTTP/2 frames directly to a gRPC server. The fix in **gRPC-Go 1.79.3** rejects any request whose `:path` does not begin with `/` and returns a **`codes.Unimplemented`** error; recommended mitigations also include adding request-validation interceptors, normalizing requests upstream, and tightening authorization policies.
Jun 29, 2026