A denial of service vulnerability in Go net/http and x/net/http2 libraries allows unauthenticated remote attackers to exhaust server resources through infinite loops, risking severe service disruption.

This flaw stems from an infinite loop condition (CWE-835) triggered when processing HTTP/2 SETTINGS frames containing a SETTINGS_MAX_FRAME_SIZE value of zero, requiring no authentication by an unauthenticated remote attacker.

A successful exploit of this vulnerability can lead to sustained denial of service by exhausting CPU and memory resources on affected servers, preventing legitimate users from accessing critical applications. With a CVSS score of 7.5, the high severity reflects the ease of remote exploitation over the network without requiring any user interaction or administrative privileges.

Immediate Action: Update the Go standard library to version 1.25.10 or 1.26.3, and update golang.org/x/net to version 0.53.0 or later.

Proactive Monitoring: Monitor server resource utilization metrics, specifically looking for sustained spikes in CPU usage and abnormal goroutine counts associated with HTTP/2 connections.

Compensating Controls: Implement rate limiting and robust connection timeouts at the load balancer or reverse proxy level to mitigate potential denial of service attacks.

Public Exploit Available: No

Given the high severity and potential for widespread availability impact, organizations utilizing the Go standard library or x/net/http2 package must prioritize applying the provided updates immediately. Upgrading to the patched versions ensures proper validation of HTTP/2 SETTINGS frames and prevents resource exhaustion loops.