News KrakenD Partners with Digital Platform Solutions to Expand Reach in Pakistan

CVE-2026-33814 High · CVSS 7.5 Low Impact

net/http: Infinite Loop in HTTP/2 Transport via Zero SETTINGS_MAX_FRAME_SIZE

Limited exploitability

Exploiting this CVE requires an uncommon setup or configuration. Upgrading is still recommended when possible.

Exploitation requires a malicious or compromised HTTP/2 backend server that sends an invalid SETTINGS_MAX_FRAME_SIZE=0 frame. KrakenD acts as an HTTP/2 client when backend connections use the HTTP/2 protocol. Deployments whose backends are accessible only over trusted internal networks are at lower risk.

Component

Go standard library (net/http)

Disclosed

May 11, 2026

CVSS Score

7.5

Description

Go’s HTTP/2 transport enters an infinite loop writing CONTINUATION frames when it receives a SETTINGS_MAX_FRAME_SIZE value of 0 from a server. A malicious or compromised HTTP/2 backend server can exploit this to hang the KrakenD request handler goroutine indefinitely, exhausting goroutine pool resources and causing denial of service.

Version summary

Community Edition

2.13.5

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.5

Enterprise Edition

2.13.3

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.3

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-33814 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates