How many golang http2 CVEs are in CISA KEV?

Yes — 1 of golang http2's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for golang http2 vulnerabilities?

Yes — 1 of golang http2's CVEs have a known public exploit.

Which versions of golang http2 are affected?

10 distinct golang http2 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in golang http2 CVEs?

golang http2's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-606 (Unchecked Input for Loop Condition).

What is the average severity of golang http2 CVEs?

The average CVSS base score across golang http2's scored CVEs is 7.0.

golang http2 Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: golang http2 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

golang http2 has 6 published CVE records since 2022, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting golang http2, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of golang http2's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High4

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

1

One of golang http2's CVEs is confirmed exploited in the wild.

Public exploits

1

One of golang http2's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every golang http2 version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 0.17.02 CVEs
< 0.23.01 CVE
< 0.4.01 CVE
< 0.53.01 CVE
< 0.7.01 CVE

Fixed in

0.17.02 CVEs
0.23.01 CVE
0.4.01 CVE
0.53.01 CVE
0.7.01 CVE

Find a version

6 CVEs

Sort

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
CVE-2026-33814
Patch
CWE-606
High · CVSS 7.5
EPSS 0.8% (53th pct)2026-05-07
HTTP/2 CONTINUATION flood in net/http
CVE-2023-45288
Patch
High · CVSS 7.5
EPSS 92.0% (100th pct)2024-04-04
HTTP/2 rapid reset can cause excessive work in net/http
CVE-2023-39325
Patch
High · CVSS 7.5
EPSS 3.8% (89th pct)2023-10-11
Medium vulnerability · 2023-10-10
CVE-2023-44487
CISA KEV
Public exploit
Patch
CWE-400
Added to CISA KEV 2023-10-10
Medium · CVSS 6.9
EPSS 100.0% (100th pct)2023-10-10
High vulnerability · 2023-02-28
CVE-2022-41723
Patch
High · CVSS 7.5
EPSS 4.6% (91th pct)2023-02-28
Medium vulnerability · 2022-12-08
CVE-2022-41717
Patch
Medium · CVSS 5.3
EPSS 5.6% (92th pct)2022-12-08

Common weakness types

The CWE weakness categories most often found in golang http2 CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many golang http2 CVEs were published each year.

2022

1

2023

3

2024

1

2026

1

Other golang products

Browse vulnerabilities for other products by golang.

go178 CVEs crypto23 CVEs net14 CVEs image6 CVEs text4 CVEs ssh3 CVEs tiff3 CVEs networking2 CVEs

All golang vulnerabilities

Frequently asked questions

Common questions about golang http2 vulnerabilities.

How many CVEs does golang http2 have?: golang http2 has 6 published CVE records since 2022.
How many golang http2 CVEs are in CISA KEV?: Yes — 1 of golang http2's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for golang http2 vulnerabilities?: Yes — 1 of golang http2's CVEs have a known public exploit.
Which versions of golang http2 are affected?: 10 distinct golang http2 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in golang http2 CVEs?: golang http2's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-606 (Unchecked Input for Loop Condition).
What is the average severity of golang http2 CVEs?: The average CVSS base score across golang http2's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.