A critical denial of service vulnerability in the Go x/net/http2 package allows unauthenticated remote attackers to crash server applications via malicious HTTP/2 frame injection.

The vulnerability is a NULL pointer dereference (CWE-476) caused by a missing nil check when processing HTTP/2 frames with types 0x0a through 0x0f. This flaw can be triggered by an unauthenticated attacker sending these specific frames to a vulnerable endpoint.

The ability for an unauthenticated attacker to remotely force a process to panic creates a significant risk of service interruption. Because this vulnerability targets the underlying HTTP/2 handling logic, it can lead to widespread system downtime for any application utilizing the affected library, causing loss of availability and potential operational disruption. The CVSS score of 7.5 reflects the high impact on service availability.

Immediate Action: Update the golang.org/x/net/http2 dependency to version 0.51.0 or later to include the necessary NULL pointer check.

Proactive Monitoring: Monitor server logs for frequent application crashes or unexpected service restarts that correlate with HTTP/2 traffic patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an ingress controller capable of inspecting and dropping malformed or non-standard HTTP/2 frames.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for complete service denial, organizations should prioritize updating their dependencies immediately. Ensure that all Go-based projects utilizing the x/net/http2 module are audited and patched to the secure version to prevent potential service instability.