VDB
RHSA-2026:74434
RHSA-2026:74434
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-node-exporter-rhel9@sha256:7d641590fcc628ef7e76fed6f5834700662e6c15927f28c9fb0c5757d5913dd5_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:5edf76e479769693b6b6931023bfde2ed592938793f73be6e49ed3b895a651a0_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:fd0e6fa2a99fdd32d67fc763d9763af91748b7e6ff215b21037aec91b3083a20_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:c6f319ad0e4abe890a9d8d70c05120fad85d392d788ecbd30053f3134625955b_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:3631b0d51b4f01596e9903e1748f58d6ebcdfd1d99d49f89c68a6d175e002f8f_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-node-driver-registrar-rhel9@sha256:8f2cf8e67887aa0f3b32c43f5e1c1d7eaf95354b8cc37dde4e4f1ace094ee17c_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:6e80fabfc8e7db48a16548810a90c0862b3ee44cd510b6802b06deb88d68585c_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-state-metrics-rhel9@sha256:02b5f2699e2849d1b5cfedb964004e211a549a17471d3fe48b4aeabcd61f36be_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-libvirt-machine-controllers-rhel9@sha256:9d92b63d1fe5ecd38b448c99f34ada481d2aee978f90ff73f995f5b1d7d73fd4_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator@sha256:62c9fde89b8e818b03034f63880c2ad6593c4133344957cd22b018341b6f230f_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator@sha256:ffb6dee88f400cb4ce7f3c67ea5c3cab64023f32cdf3956c55e7dbf2275416b8_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel9@sha256:8a19004c2c83d0c43395efdee6279951b329cc5e244f71f40f106717028ed003_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-network-rhel9-operator@sha256:2dbebe9aa66efc029dd04171ffe761d8fc76d9b7c9e49d5267e505a218ae0b62_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:578419bddde7c635c23714c51028bbb37dd49a9da631c7b374f963599d6b71e8_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9@sha256:5e1b12824e23f24325c71140d6a22b5fb3306662c39a4326b083bd5255b17105_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-image-registry-rhel9-operator@sha256:0ca7be528f9a961007d5fad9970d79cd52500c9b1cea976a21177b971d5077f6_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9@sha256:df3f5f12abed46d87d26f319d875346a535313c323e98cb2f72d25d95f0ed327_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:3f1f2bf7b603d01224cd982463007d7fbccfc354fbdb6e3759b3a800281372ad_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-problem-detector-rhel9@sha256:9d701d46f1d058c075bc4a570ae2a3c6941a8dae66dc79ccf9e2549f1ae276a4_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-rhel9-operator@sha256:0347d42acf58f80f920fe2f98c3a6d7ed47fe05d34bcb3d3004c3f524a6fe024_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
…and 630 more
Timeline
- Oct 7, 2026 CVE Published
- Oct 12, 2026 CVE Updated
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:74434 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-39832 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-49329 advisory
- https://access.redhat.com/security/cve/CVE-2026-96577 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74434.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4918 advisory
…and 46 more