net/http/internal/http2: SETTINGS_MAX_FRAME_SIZE=0 causes Transport to loop infinitely

[nicholashusin]

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of
writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a
value of 0.

This allows potential DoS against a client by a malicious server. HTTP/2
transport now properly checks that the received SETTINGS_MAX_FRAME_SIZE is
valid.

Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.

This is CVE-2026-33814 and Go issue https://go.dev/issue/78476.

---

This was a PUBLIC track issue, tracked in http://b/496352405.

[nicholashusin]

@gopherbot please open backport issues for this security fix

[gopherbot]

Backport issue(s) opened: #78477 (for 1.25), #78478 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/761581 mentions this issue: net/http/internal/http2: prevent hanging Transport due to bad SETTINGS frame

[gopherbot]

Change https://go.dev/cl/761640 mentions this issue: http2: prevent hanging Transport due to bad SETTINGS frame