CVE-2026-27141 Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
Attackers can crash Go servers by sending specific HTTP/2 frames due to a missing nil check in the golang.org/x/net library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27141?
CVE-2026-27141 is a high-severity vulnerability in golang.org/x/net/http2, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Weakness: CWE-476
Which versions are affected by CVE-2026-27141?
1 open source package ship an affected version, including golang.org/x/net.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net Go | From 0.50.0 | 0.51.0 |
Linux distribution packages (1)
telemetrygen openSUSE:Tumbleweed | All versions | 0.147.0-1.1 |
How do I fix CVE-2026-27141?
Upgrade golang.org/x/net to 0.51.0 or later.
Is CVE-2026-27141 being exploited?
There is no known exploitation of CVE-2026-27141 in the wild and no public exploit code.
Sources
Also known as AZL-78629, AZL-78653, AZL-78656, AZL-78659, AZL-78662, AZL-78680 and 91 more.