CERT24rhsa-2026:57367: Denial-of-Service vulnerabilities in brace-expansion and Go HTTP/2 implementationLoading data…
CERT24Threat Observatory
Period

rhsa-2026:57367: Denial-of-Service vulnerabilities in brace-expansion and Go HTTP/2 implementation

The source describes denial-of-service (DoS) vulnerabilities. Specially crafted input to the expand() function can cause excessive memory consumption and crash the application. In the Go HTTP/2 implementation, a specially crafted SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero can cause an infinite loop writing CONTINUATION frames and exhaust resources.

← Back to intelligence

rhsa-2026:57367: Denial-of-Service vulnerabilities in brace-expansion and Go HTTP/2 implementation

The source describes denial-of-service (DoS) vulnerabilities. Specially crafted input to the expand() function can cause excessive memory consumption and crash the application. In the Go HTTP/2 implementation, a specially crafted SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to zero can cause an infinite loop writing CONTINUATION frames and exhaust resources.