CVE-2026-27141
HIGHgolang.org/x/net/http2 0.50.0-0.50.9 - Denial of Service via Malformed HTTP/2 Frame
Title source: llmDescription
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
References (4)
Core 4
Core References
Various Sources
https://go.dev/cl/746180
Issue Tracking
https://go.dev/issue/77652
Various Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-27141
Various Sources
https://pkg.go.dev/vuln/GO-2026-4559
Scores
CVSS v3
7.5
EPSS
0.0050
EPSS Percentile
38.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-476
Status
published
Products (1)
golang.org/x/net/golang.org/x/net/http2
0.50.0 - 0.51.0
Published
Feb 26, 2026
Tracked Since
Feb 27, 2026