Description
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| golang.org/x/net | golang.org/x/net/http2 | 0.50.0 – < 0.51.0 | 0.51.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | adsys | 0.16.4ubuntu1.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | golang1.25 +6 | 1.25.9-1.hum1 | RHSA-2026:7385 |
| Red Hat Hardened Images 1 | golang1.26 +6 | 1.26.2-1.hum1 | RHSA-2026:7291 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rclone | 1.73.2-1.1 | openSUSE-SU-2026:10313-1 |
| openSUSE Tumbleweed | telemetrygen | 0.147.0-1.1 | openSUSE-SU-2026:10294-1 |
| openSUSE Tumbleweed | traefik | 3.6.10-2.1 | openSUSE-SU-2026:10385-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | rclone | 1.74.4-bp160.1.1 | openSUSE-SU-2026:21436-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260226T182644-150000.1.149.1 | SUSE-SU-2026:0757-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rclone | 1.73.5-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | azurelinux-image-tools | 1.2.0-2 | — |
| Azure Linux 3 | cri-o +5 | No fix yet | — |
| Azure Linux 3 | ignition-flatcar | 2.22.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | nmi | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apko | 1.1.12-r1 | — |
| Wolfi rolling | azure-service-operator | 2.18.0-r3 | — |
| Wolfi rolling | bento | 1.16.0-r2 | — |
| Wolfi rolling | caddy | 2.11.1-r2 | — |
| Wolfi rolling | cert-manager-webhook-pdns | 2.5.5-r1 | — |
| Wolfi rolling | chezmoi | 2.69.4-r2 | — |
| Wolfi rolling | cilium-cli | 0.19.2-r2 | — |
| Wolfi rolling | cloud-sql-proxy-2.21 | 2.21.1-r1 | — |
| Wolfi rolling | cluster-api-azure-controller | 1.23.0-r1 | — |
| Wolfi rolling | crossplane-provider-aws-s3 +18 | 2.5.0-r1 | — |
| Wolfi rolling | datadog-operator | 1.26.0-r1 | — |
| Wolfi rolling | descheduler | 0.35.1-r1 | — |
| Wolfi rolling | dex | 2.45.1-r1 | — |
| Wolfi rolling | dogstatsd-7.72 +2 | 7.72.4-r16 | — |
| Wolfi rolling | dogstatsd-7.73 +2 | 7.73.3-r8 | — |
| Wolfi rolling | dogstatsd-7.77 +2 | 7.77.3-r1 | — |
| Wolfi rolling | emissary +1 | 4.0.1-r1 | — |
| Wolfi rolling | flux-2.8 | 2.8.1-r3 | — |
| Wolfi rolling | flux-kustomize-controller | 1.8.1-r1 | — |
| Wolfi rolling | gitlab-pages-18.11 | 18.11.2-r2 | — |
| Wolfi rolling | gitlab-runner-18.10 +1 | 18.10.1-r1 | — |
| Wolfi rolling | goreleaser | 2.14.1-r2 | — |
| Wolfi rolling | grafana-mimir-3.0 +3 | 3.0.6-r1 | — |
| Wolfi rolling | harbor-2.14 +3 | 2.14.2-r12 | — |
| Wolfi rolling | ksops | 4.5.1-r1 | — |
| Wolfi rolling | kube-logging-operator | 6.4.0-r2 | — |
| Wolfi rolling | kube-rbac-proxy | 0.21.0-r1 | — |
| Wolfi rolling | kube-vip | 1.1.0-r1 | — |
| Wolfi rolling | kubo | 0.40.1-r1 | — |
| Wolfi rolling | kyverno-policy-reporter | 3.7.3-r1 | — |
| Wolfi rolling | linkerd2-cli +4 | 26.2.1-r1 | — |
| Wolfi rolling | mattermost-11.5 | 11.5.1-r4 | — |
| Wolfi rolling | melange | 0.43.4-r1 | — |
| Wolfi rolling | nova | 3.11.11-r1 | — |
| Wolfi rolling | ollama | 0.19.0-r2 | — |
| Wolfi rolling | opa +2 | 1.14.0-r1 | — |
| Wolfi rolling | opentelemetry-collector | 0.147.0-r0 | — |
| Wolfi rolling | pluto | 5.23.0-r1 | — |
| Wolfi rolling | polaris | 10.1.5-r1 | — |
| Wolfi rolling | pulumi | 3.224.0-r2 | — |
| Wolfi rolling | pulumi-language-dotnet | 3.101.2-r2 | — |
| Wolfi rolling | pulumi-language-java | 1.21.2-r2 | — |
| Wolfi rolling | pulumi-language-yaml | 1.29.1-r2 | — |
| Wolfi rolling | rekor-cli +1 | 1.5.1-r1 | — |
| Wolfi rolling | sops | 3.12.1-r3 | — |
| Wolfi rolling | splunk-otel-collector +1 | 0.146.0-r2 | — |
| Wolfi rolling | src | 7.3.0-r2 | — |
| Wolfi rolling | terraform-provider-acme | 2.45.0-r1 | — |
| Wolfi rolling | terraform-provider-aws | 6.34.0-r1 | — |
| Wolfi rolling | terraform-provider-grafana | 4.26.0-r1 | — |
| Wolfi rolling | timestamp-authority-server | 2.0.5-r2 | — |
| Wolfi rolling | timoni | 0.26.0-r1 | — |
| Wolfi rolling | traefik-3.6 | 3.6.9-r2 | — |
| Wolfi rolling | trivy | 0.69.3-r5 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r1 | — |
| Wolfi rolling | vertical-pod-autoscaler +2 | 1.6.0-r1 | — |
| Wolfi rolling | wolfictl | 0.39.3-r1 | — |
| Wolfi rolling | zarf | 0.73.1-r1 | — |
| Wolfi rolling | zot | 2.1.15-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | golang.org/x/net | >= 0.50.0, < 0.51.0 | 0.51.0 | GO-2026-4559 |
Advisories 11
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- WID-SEC-2026-1618 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:7385 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7291 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:21436-1 Security update for rclone SUSE / openSUSE Security Updates · Jul 24, 2026
- WID-SEC-2026-1654 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- openSUSE-SU-2026:10294-1 telemetrygen-0.147.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10385-1 traefik-3.6.10-2.1 on GA media SUSE / openSUSE Security Updates · Mar 18, 2026
- openSUSE-SU-2026:10313-1 rclone-1.73.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 10, 2026
- SUSE-SU-2026:0757-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 4, 2026