A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-docsUpgrade grafana-pcpUpgrade delveUpgrade golang-testsUpgrade golang-binUpgrade grafana-selinuxUpgrade go-toolsetUpgrade grafanaUpgrade golang-srcUpgrade golang-raceUpgrade golang-miscUpgrade golang | Oct 22, 2026 | Oct 20, 2026 |
| Alpine Linux | — | Upgrade dockerUpgrade go | Oct 15, 2026 | Oct 8, 2026 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade golang-docsUpgrade golang-testsUpgrade golang-sharedUpgrade golang-bin | Oct 28, 2026 | Oct 8, 2026 |
| Oracle_linux | — | Upgrade yggdrasilUpgrade delveUpgrade golang-testsUpgrade podman-dockerUpgrade golang-raceUpgrade podmanUpgrade podman-testsUpgrade golang-binUpgrade golang-srcUpgrade golangUpgrade grafanaUpgrade buildahUpgrade grafana-selinuxUpgrade buildah-testsUpgrade podman-remoteUpgrade grafana-pcpUpgrade go-toolsetUpgrade yggdrasil-develUpgrade ipp-usbUpgrade golang-miscUpgrade golang-docs | Oct 22, 2026 | Oct 8, 2026 |
| Redhat_linux | — | Upgrade buildah-debuginfoUpgrade podmanUpgrade buildahNo solution existsUpgrade podman-dockerUpgrade delve-debugsourceUpgrade golang-miscUpgrade yggdrasil-debuginfoUpgrade osbuild-composer-debugsourceUpgrade grafana-pcp-debugsourceUpgrade yggdrasil-examples-debuginfoUpgrade podman-tests-debuginfoUpgrade golang-binUpgrade podman-testsUpgrade buildah-testsUpgrade ipp-usbUpgrade osbuild-composer-worker-debuginfoUpgrade golang-raceUpgrade buildah-tests-debuginfoUpgrade grafana-selinuxUpgrade golang-testsUpgrade yggdrasil-debugsourceUpgrade podman-remoteUpgrade osbuild-composerUpgrade receptorctlUpgrade podman-debuginfoUpgrade grafana-pcp-debuginfoUpgrade grafana-debuginfoUpgrade golang-docsUpgrade golangUpgrade rhcUpgrade rhc-debuginfoUpgrade yggdrasil-develUpgrade osbuild-composer-coreUpgrade grafana-debugsourceUpgrade receptorUpgrade receptor-debugsourceUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade go-toolsetUpgrade golang-srcUpgrade ipp-usb-debuginfoUpgrade rhc-develUpgrade podman-remote-debuginfoUpgrade delveUpgrade receptor-debuginfoUpgrade buildah-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-composer-debuginfoUpgrade yggdrasilUpgrade delve-debuginfoUpgrade rhc-debugsourceUpgrade podman-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade grafana-pcp | Oct 13, 2026 | Oct 8, 2026 |
| Rocky_linux | — | Upgrade buildah-testsUpgrade podman-debugsourceUpgrade delveUpgrade grafana-pcp-debugsourceUpgrade podman-tests-debuginfoUpgrade podman-debuginfoUpgrade grafanaUpgrade grafana-debugsourceUpgrade golang-binUpgrade grafana-pcpUpgrade go-toolsetUpgrade ipp-usb-debuginfoUpgrade ipp-usbUpgrade podman-remoteUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade delve-debugsourceUpgrade podmanUpgrade podman-remote-debuginfoUpgrade buildahUpgrade buildah-debugsourceUpgrade golang-raceUpgrade grafana-selinuxUpgrade grafana-pcp-debuginfoUpgrade golangUpgrade delve-debuginfoUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade grafana-debuginfoUpgrade podman-tests | Oct 22, 2026 | Oct 21, 2026 |
| Ubuntu | — | Upgrade golang-1.22-goUpgrade golang-1.22Upgrade golang-1.22-src | Oct 19, 2026 | Oct 8, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub