CVE-2026-33814Patch(golang / go)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch golang go systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

golang CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://pkg.go.dev/vuln/GO-2026-4918

Other references

Weakness type (CWE)

CWE-835CWE-606

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

go
http2

Threat summary

Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 3d ago at 1 mentions (2026-05-07); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

golang

Products

gohttp2

Deep dive

Activity timeline4 mentions / 4d

Signal classification3 categories

Patch

250.0%

General

125.0%

Disclosure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-07	1	General1
2026-05-15	1	Patch1
2026-06-11	1	Patch1
2026-06-19	1	Disclosure1

Full discourse4 posts

Ferramentas Linux@Cezar_H_Linux111d
Disclosure
🛡️ #SUSE #Kubernetes: duas vulnerabilidades críticas (CVE-2026-33814 e CVE-2026-35469) permitem DoS remoto. Saiba mais: -> http://tinyurl.com/5ee7ab7u https://t.co/hmb5X7OqTa
Post summary
The tweet announces the disclosure of two critical SUSE Kubernetes CVEs that enable remote Denial‑of‑Service attacks.
1000048
1.5K followersView on X
ThreatCluster@threatcluster120d
Patch
SUSE released security fixes for CVE-2026-33186 in google-osconfig-agent (authorisation bypass, CVSS 9.1) and CVE-2026-33814 in google-cloud-sap-agent (HTTP/2 DoS, CVSS 7.5) affecting Public Cloud Module 12, according to SUSE advisories. https://threatcluster.io/cluster/suse-fixes-critical-authorization-bypass-and-dos-vulnerabili-f3c14e34
Post summary
SUSE has issued patches for CVE‑2026‑33186 (authorization bypass) and CVE‑2026‑33814 (HTTP/2 DoS) in google‑osconfig‑agent and google‑cloud‑sap‑agent, addressing critical vulnerabilities in Public Cloud Module 12.
0001079
327 followersView on X
ThreatCluster@threatcluster146d
Patch
BREAKING: SUSE issues Go1.26 and Go1.25 security updates fixing DoS CVEs CVE-2026-33811 and CVE-2026-33814 in net and HTTP/2, administrators urged to patch affected SUSE Linux systems immediately. https://threatcluster.io/cluster/suse-linux-go126-and-go125-security-updates-address-critical-44c07030
Post summary
SUSE has released security updates for Go 1.26 and 1.25 to address DoS vulnerabilities CVE-2026-33811 and CVE-2026-33814, urging administrators to apply the patches immediately.
0000069
277 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds154d
General
CVE-2026-33814 Infinite Loop Denial of Service in HTTP/2 SETTINGS Frame Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33814
Post summary
CVE‑2026‑33814 is a denial‑of‑service vulnerability involving an infinite loop during HTTP/2 SETTINGS frame processing, with no PoC, exploit, patch, or active exploitation reported.
0000044
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	golang	go	-	-	-
App	golang	http2	-	go	-

Explore more

Back to dashboard golang CVEs go vulnerabilities

What researchers are saying

CVE-2026-33814

ThreatCluster[verified]@threatclusterPatch

SUSE has issued patches for CVE‑2026‑33186 (authorization bypass) and CVE‑2026‑33814 (HTTP/2 DoS) in google‑osconfig‑agent and google‑cloud‑sap‑agent, addressing critical vulnerabilities in Public Cloud Module 12.

ThreatCluster[verified]@threatclusterPatch

SUSE has released security updates for Go 1.26 and 1.25 to address DoS vulnerabilities CVE-2026-33811 and CVE-2026-33814, urging administrators to apply the patches immediately.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The tweet announces the disclosure of two critical SUSE Kubernetes CVEs that enable remote Denial‑of‑Service attacks.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

CVE‑2026‑33814 is a denial‑of‑service vulnerability involving an infinite loop during HTTP/2 SETTINGS frame processing, with no PoC, exploit, patch, or active exploitation reported.