CVE-2026-27141: HTTP/2 Server DOS Vulnerability

CVE-2026-27141 Overview

CVE-2026-27141 is a Null Pointer Dereference vulnerability affecting Go HTTP/2 server implementations. Due to a missing nil check in the HTTP/2 frame handling code, an attacker can send specially crafted HTTP/2 frames with type values in the range 0x0a-0x0f to cause a running server to panic and crash. This vulnerability represents a Denial of Service (DoS) condition that can be triggered remotely without authentication.

Critical Impact

Remote attackers can crash Go HTTP/2 servers by sending malformed HTTP/2 frames, causing service disruption without requiring authentication or special privileges.

Affected Products

• Go HTTP/2 server implementations (golang.org/x/net/http2)
• Applications using affected versions of the Go net/http package with HTTP/2 support

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27141 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27141

Vulnerability Analysis

This vulnerability stems from improper input validation in Go's HTTP/2 frame processing logic. HTTP/2 defines several frame types (identified by single-byte type codes), including standard types like DATA (0x00), HEADERS (0x01), and SETTINGS (0x04). Frame types in the range 0x0a-0x0f are either reserved or implementation-specific. The vulnerable code path fails to perform a nil check before dereferencing a pointer when processing these particular frame types.

When the HTTP/2 server receives a frame with type values 0x0a through 0x0f, the missing nil validation causes the Go runtime to panic, immediately terminating the server process. This creates a straightforward denial of service vector that requires only network access to the target server.

Root Cause

The root cause is a missing nil pointer check in the HTTP/2 frame handler. When processing frames with type codes 0x0a-0x0f, the code assumes a certain data structure is properly initialized. However, for these specific frame types, the initialization may not occur, resulting in a nil pointer that is subsequently dereferenced, triggering a Go runtime panic.

The fix, as documented in the Go.dev Change Log Entry, adds the necessary nil check before accessing the pointer, preventing the panic condition.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by establishing an HTTP/2 connection to the vulnerable server and sending a crafted frame. The attack does not require authentication, user interaction, or any special privileges.

The attack sequence involves:

1. Establishing a valid HTTP/2 connection to the target server
2. Constructing an HTTP/2 frame with the type byte set to any value between 0x0a and 0x0f
3. Sending the malformed frame to the server
4. The server processes the frame, hits the nil pointer dereference, and panics

Since HTTP/2 uses binary framing, this attack requires crafting raw HTTP/2 frames rather than using standard HTTP client libraries. Repeated exploitation can prevent the service from recovering, especially in environments without automatic restart mechanisms.

Detection Methods for CVE-2026-27141

Indicators of Compromise

• Unexpected Go server crashes with panic stack traces referencing HTTP/2 frame handling code
• Log entries indicating runtime panic with nil pointer dereference in net/http2 or golang.org/x/net/http2 packages
• Sudden service terminations following HTTP/2 connection establishment from external sources

Detection Strategies

• Monitor Go application logs for panic stack traces containing references to HTTP/2 frame processing functions
• Implement network-level monitoring to detect unusual HTTP/2 frame patterns, particularly frames with type values 0x0a-0x0f
• Deploy application-level health checks to detect and alert on unexpected server restarts

Monitoring Recommendations

• Configure process monitoring to track unexpected terminations of Go HTTP/2 services
• Enable verbose logging for HTTP/2 frame processing if available in your Go application
• Implement automated alerting for repeated server crashes within short time windows

How to Mitigate CVE-2026-27141

Immediate Actions Required

• Update Go and the golang.org/x/net package to the patched version containing the fix from Go.dev Change Log Entry
• Review the Go.dev Vulnerability Advisory for specific version guidance
• Implement process supervision to automatically restart crashed services while patching is underway

Patch Information

The vulnerability has been addressed in the Go project. Refer to the following resources for patch details:

• Go.dev Change Log Entry - Contains the code fix adding the missing nil check
• Go.dev Issue Report - Original issue report and discussion
• Go.dev Vulnerability Advisory - Official vulnerability advisory with affected versions

Organizations should update their Go toolchain and rebuild affected applications, or update the golang.org/x/net dependency directly if using Go modules.

Workarounds

• Deploy a reverse proxy or load balancer in front of vulnerable Go HTTP/2 servers that can filter or sanitize HTTP/2 frames
• Temporarily disable HTTP/2 support and fall back to HTTP/1.1 if acceptable for your environment
• Implement process supervision (systemd, supervisord, Kubernetes restart policies) to automatically restart crashed services
• Consider rate limiting new HTTP/2 connections to reduce the impact of repeated exploitation attempts