What’s Vulnerable › Products

Golang Http2 vulnerabilities

6 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your Golang Http2 version is affected

Exploited Golang Http2 vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest Golang Http2 vulnerabilities

• CVE-2026-33814 — Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net (CVSS 7.5)
• CVE-2023-45288 — HTTP/2 CONTINUATION flood in net/http (CVSS 7.5)
• CVE-2023-39325 — HTTP/2 rapid reset can cause excessive work in net/http (CVSS 7.5)
• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
• CVE-2022-41723 — Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net (CVSS 7.5)
• CVE-2022-41717 — Excessive memory growth in net/http and golang.org/x/net/http2 (CVSS 5.3)