client denial of service

CVE-2026-33814 is a Go HTTP/2 denial-of-service flaw disclosed in May 2026, fixed in Go 1.26.3 and 1.25.10, where a malicious server can make a Go client loop endlessly after receiving an invalid SETTINGS_MAX_FRAME_SIZE value of zero. It is not a remote-code-execution bug, and it does not hand...