How many golang http2 CVEs are in CISA KEV?

Yes — 1 of golang http2's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for golang http2 vulnerabilities?

Yes — 1 of golang http2's CVEs have a known public exploit.

Which versions of golang http2 are affected?

10 distinct golang http2 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in golang http2 CVEs?

golang http2's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), CWE-606 (Unchecked Input for Loop Condition).

What is the average severity of golang http2 CVEs?

The average CVSS base score across golang http2's scored CVEs is 7.0.

golang http2 Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: golang http2 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

golang http2 Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

golang http2 has 6 published CVE records since 2022, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

Severity and exploitation

How the CVSS severity of golang http2's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High4

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

One of golang http2's CVEs is confirmed exploited in the wild.

Public exploits

One of golang http2's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every golang http2 version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 0.17.02 CVEs
< 0.23.01 CVE
< 0.4.01 CVE
< 0.53.01 CVE
< 0.7.01 CVE

Fixed in

0.17.02 CVEs
0.23.01 CVE
0.4.01 CVE
0.53.01 CVE
0.7.01 CVE

Find a version

6 CVEs

Sort

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
CVE-2026-33814
Patch
CWE-606
High · CVSS 7.5
EPSS 0.8% (55th pct)2026-05-07
HTTP/2 CONTINUATION flood in net/http
CVE-2023-45288
Patch
High · CVSS 7.5
EPSS 92.0% (100th pct)2024-04-04
HTTP/2 rapid reset can cause excessive work in net/http
CVE-2023-39325
Patch
CWE-770
High · CVSS 7.5
EPSS 3.8% (90th pct)2023-10-11
HTTP/2 Stream Cancellation Attack
CVE-2023-44487
CISA KEV
Public exploit
Patch
CWE-400
Added to CISA KEV 2023-10-10
Medium · CVSS 6.9
EPSS 100.0% (100th pct)2023-10-10
golang.org/x/net vulnerable to Uncontrolled Resource Consumption
CVE-2022-41723
Patch
High · CVSS 7.5
EPSS 4.6% (91th pct)2023-02-28
golang.org/x/net/http2 vulnerable to possible excessive memory growth
CVE-2022-41717
Patch
CWE-770
Medium · CVSS 5.3
EPSS 6.1% (93th pct)2022-12-08

Common weakness types

The CWE weakness categories most often found in golang http2 CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many golang http2 CVEs were published each year.

2022

2023

2024

2026

Other golang products

Browse vulnerabilities for other products by golang.

go177 CVEs crypto25 CVEs net14 CVEs image6 CVEs text4 CVEs ssh3 CVEs tiff3 CVEs networking2 CVEs

All golang vulnerabilities

Frequently asked questions

Common questions about golang http2 vulnerabilities.

How many CVEs does golang http2 have?: golang http2 has 6 published CVE records since 2022.
How many golang http2 CVEs are in CISA KEV?: Yes — 1 of golang http2's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for golang http2 vulnerabilities?: Yes — 1 of golang http2's CVEs have a known public exploit.
Which versions of golang http2 are affected?: 10 distinct golang http2 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in golang http2 CVEs?: golang http2's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), CWE-606 (Unchecked Input for Loop Condition).
What is the average severity of golang http2 CVEs?: The average CVSS base score across golang http2's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track golang http2 vulnerabilities

Get an alert for each new golang http2 CVE, with AI-written analysis and remediation steps.

Create an account See pricing