RHSA-2026:80167 | Vulnetix

RHSA-2026:80167 PUBLISHED CVSS 8.100000381469727 HIGH

A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.

Risk Scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected Products

Timeline

Oct 15, 2026 CVE Published
Oct 15, 2026 CVE Updated
Oct 15, 2026 Distribution Patch
Oct 15, 2026 Distribution Patch
Oct 15, 2026 Security Advisory
Oct 15, 2026 Security Advisory
Oct 15, 2026 Security Advisory
Oct 15, 2026 Security Advisory
Oct 15, 2026 Security Advisory
Oct 15, 2026 Security Advisory
Oct 15, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:80167 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2515838 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 issue
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80167.json advisory
https://access.redhat.com/security/cve/CVE-2026-33814 advisory
https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
https://go.dev/cl/761581 advisory
https://go.dev/cl/761640 advisory
https://go.dev/issue/78476 advisory
https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
https://pkg.go.dev/vuln/GO-2026-4918 advisory
https://access.redhat.com/security/cve/CVE-2026-33818 advisory
https://www.cve.org/CVERecord?id=CVE-2026-33818 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 advisory

…and 29 more

Open in Interactive Console →

Vendor	Product	Versions
Red Hat	microshift-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.src as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.src
Red Hat	microshift-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86
Red Hat	microshift-gateway-api-release-info-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-multus-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86
Red Hat	microshift-networking-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64
Red Hat	microshift-multus-release-info-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-olm-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64
Red Hat	microshift-release-info-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-multus-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64
Red Hat	microshift-olm-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86
Red Hat	microshift-selinux-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-networking-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86
Red Hat	microshift-gateway-api-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.x86
Red Hat	microshift-gateway-api-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64
Red Hat	microshift-greenboot-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-low-latency-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-olm-release-info-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.noarch
Red Hat	microshift-0:4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.18	4.18.57-202610092321.p0.g94a47d0.assembly.4.18.57.el9.aarch64