VDB
RHSA-2026:70648
RHSA-2026:70648
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-egress-dns-proxy@sha256:e1cdfc9b948355ce6e19785e456317db263c7ee3730e369b80ac8bbee615d04c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-operator@sha256:746accfae6f690c8bf32342f6ef29550b564cb6844fd7cc34a08a22da9f1b4cb_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel8-operator@sha256:83d3b12c76de2847cd8723a58c52893b82ffe4df09a70af2616081d4e8a06f47_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:d87c723b051eba9ed30ac74404cbf19c8cfe96ef47a045b81120846597380745_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:0c9451b116bf48e1f7dc978db5ca20544ef4dfbb1fafb76f61899ad7fd095ae6_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:c133877d491d4d0fabbb88ab7734e39119db479e84423213380a09bf96919141_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-webhook@sha256:95b6220abfdd552d7676e2168c008470ccaeeeb98b452de5b91966696d55527a_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:f562c0f1de141d4349a68dde9d8f1f150c4e7cc4e9e68e1dc0c704123bb936de_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ptp-must-gather-rhel8@sha256:ae51cd66dce5ec8da56984f59525f54721729f50d054188e016a6206e8f2422a_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-operator@sha256:ff21e346819c92ff224c9764ba88198d6c73a03b5e76f29765e023913ab0f456_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-contour-rhel8@sha256:4bae5261a4c8851689d62a3897b5464f44307b6132bbcbeca2455d33ce836922_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller@sha256:9e94dbcacca7415dd3e7490f85cd86f24694591f35b18de689e9ec0389c810a5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel8@sha256:032b2336f045ea691727d6c2aa9d7082ad29463dfebe0e0ecb2400a83d0fe3b5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-infiniband-cni@sha256:d9429519eeb0e1e7afeca1116c3102272882ac8c24d7a9af2dd2c4ea68606bf9_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel8-operator@sha256:6e20073f1cd7b531f766c9f6075de1fa091ea1f37d1284a43d1a389bba3d3dac_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:0e0ed6ace59908187dfc2d25825611ac3179a2d4793f9edf716925b9d254e064_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-sdk-rhel8@sha256:f22058ff92e53a4eb0346a10eda6b5e4856ad894a6f5727d761a373ce205173c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:b74bed13c5c6a422efcd3a9adbb2a45eab45901fce0a9d1dcdc376c2c426fdef_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:032b2336f045ea691727d6c2aa9d7082ad29463dfebe0e0ecb2400a83d0fe3b5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8-operator@sha256:9ad2767f80b57843441d846e2e88f38e5f6a4b200a05b27ec25ba1b1e7af2405_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
…and 20 more
Timeline
- Oct 1, 2026 CVE Published
- Oct 4, 2026 CVE Updated
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:70648 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70648.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4918 advisory