VDB
RHSA-2026:73853
RHSA-2026:73853
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator@sha256:a2c091dd14bc1ced97443dc9d6d7f2203bf49eaa149763909e78d7726f73dc05_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshotter-rhel9@sha256:d45d60d3f1bef8f7f9c087c20a19fa6db2fc26712fac9d7c9de64ea8231e0d17_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9-operator@sha256:dfc4baf11425faa8121445645d452346c50ecbc5f3540916e4da5e966ed50684_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:12a661d61a3cbab892c554aab78bfd45daa08b1ec6b218b7911fc13adb3032ea_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-machine-approver-rhel9@sha256:69f666db798ffe3ee0dd678c5d5a7f10ac210aa69124e357fddf81b05beb6142_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9@sha256:54da8c03995ca705563a147a4cba630d710e49ea6df97c119b38c79e3c641f16_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-apiserver-rhel9@sha256:127db7ca842138cb0707cac984a4384cbc998a6689ac0a31d58b3d40330a5594_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-node-exporter-rhel9@sha256:0c7b6131aa7632a209c019f027264cf913753b03cd02caf0ddca84a0ad891004_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-machine-approver-rhel9@sha256:a7cf11a32ee5f5833f72db454aa76b0c4a0cc2c821d4a14c0f9ad6f645583508_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:81ccee1e1350aa56d15b4200201723b9aabf655f3e66a9e4d97e5a232567b3a2_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cli-artifacts-rhel9@sha256:b6bf04acf55b859dc3018ca3c273e2ec205833c40b49be36373b3f4dc25f023c_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:0a07a3bad416fad7a80bc28bc97ff1db0317371568aa7f47e5e2e98b0a56e4cd_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-policy-controller-rhel9@sha256:2d309dd99fd541e45350b3c5bc3cbbbc13c6825b6d94e1f6b3284809df78678d_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9@sha256:2abc25ab72bc9645b367c930a82f2dcf720d4e4a025e1315fd8648afb6f2cf29_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:2145731f71d14ddb1abe4fc9330f00819b9d2ce7f4d9ebcdd13dc1689762642f_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-state-metrics-rhel9@sha256:9f7d87440b0530081c8387de8bae26c8a06a2d26f54846644b9bb4d23da86aff_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:ef0ac5b969fb621b9d0543f570c74d782d31934b57c6efa36374b89f1e156b5d_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-insights-rhel9-operator@sha256:4a705d06a12367ef7210551f18e25dccfab0a6b84dbf32ea27768dd921e6c072_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator@sha256:7a2f846eac19cf49f121374ca64ef8e50d340d225bf5bf6b212b6c73a1bae798_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:99ddd14135a5a9848c4a091fa60f456fb8502d9457c41d1e420f00b54f1222b7_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
…and 632 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 12, 2026 CVE Updated
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:73853 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-39832 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-75885 advisory
- https://access.redhat.com/security/cve/CVE-2026-75887 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73853.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4918 advisory
…and 47 more