CVE-2026-27141
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Feb 26, 2026
CISA due date
—
The record
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | golang.org/x/net | 0.50.0 | 0.51.0 |
| Chainguard | amazon-ssm-agent | 0 | 3.3.3270.0-r8 |
| Chainguard | amazon-ssm-agent-ecs-exec | 0 | 3.3.3270.0-r8 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r9 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r9 |
| Chainguard | apko | 0 | 1.1.12-r1 |
| Chainguard | apko-fips | 0 | 1.1.12-r1 |
| Chainguard | apm-server-8.19 | 0 | 8.19.12-r1 |
| Chainguard | apm-server-9.2 | 0 | 9.2.6-r1 |
| Chainguard | apm-server-9.3 | 0 | 9.3.1-r1 |
| Chainguard | apm-server-fips-8.19 | 0 | 8.19.12-r1 |
| Chainguard | apm-server-fips-9.2 | 0 | 9.2.6-r1 |
| Chainguard | apm-server-fips-9.3 | 0 | 9.3.1-r1 |
| Chainguard | aws-ebs-csi-driver-1.56 | 0 | 1.56.0-r1 |
| Chainguard | aws-ebs-csi-driver-fips-1.56 | 0 | 1.56.0-r2 |
| Chainguard | azure-service-operator | 0 | 2.18.0-r3 |
| Chainguard | azure-service-operator-fips | 0 | 2.18.0-r2 |
| Chainguard | bento | 0 | 1.16.0-r2 |
| Chainguard | bento-fips | 0 | 1.16.0-r4 |
| Chainguard | buf | 0 | 0 |
| Chainguard | buildkite-agent | 0 | 3.118.1-r1 |
| Chainguard | buildkite-agent-fips | 0 | 3.119.1-r1 |
| Chainguard | caddy | 0 | 2.11.1-r2 |
| Chainguard | caddy-fips | 0 | 2.11.1-r1 |
| Chainguard | cert-manager-webhook-pdns | 0 | 2.5.5-r1 |
| Chainguard | cert-manager-webhook-pdns-fips | 0 | 2.5.5-r1 |
| Chainguard | cg | 0 | 0.2.219-r0 |
| Chainguard | chainctl | 0 | 0.2.221-r1 |
| Chainguard | chezmoi | 0 | 2.69.4-r2 |
| Chainguard | chisel | 0 | 0 |
| Chainguard | chisel-fips | 0 | 0 |
| Chainguard | chrony_exporter | 0 | 0 |
| Chainguard | chrony_exporter-fips | 0 | 0 |
| Chainguard | cilium-cli | 0 | 0.19.2-r2 |
| Chainguard | cloud-sql-proxy-2.21 | 0 | 2.21.1-r1 |
| Chainguard | cloud-sql-proxy-fips | 0 | 2.21.1-r1 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.12-r2 |
| Chainguard | cloudbeat-9.3 | 0 | 9.3.1-r2 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.12-r1 |
| Chainguard | cloudbeat-fips-9.3 | 0 | 9.3.1-r2 |
| Chainguard | cluster-api-azure-controller | 0 | 1.23.0-r1 |
| Chainguard | cluster-api-azure-controller-fips | 0 | 1.23.0-r1 |
| Chainguard | contour-1.31 | 0 | 1.31.5-r1 |
| Chainguard | contour-1.32 | 0 | 1.32.4-r1 |
| Chainguard | contour-1.33 | 0 | 1.33.3-r1 |
| Chainguard | contour-fips-1.31 | 0 | 1.31.5-r1 |
| Chainguard | contour-fips-1.32 | 0 | 1.32.4-r1 |
| Chainguard | contour-fips-1.33 | 0 | 1.33.3-r1 |
| Chainguard | crossplane-provider-aws-acm | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-acm-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-backup | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-backup-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cloudformation | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cloudformation-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-cloudfront | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cloudfront-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-cloudwatchlogs | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cloudwatchlogs-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-cognitoidentity | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cognitoidentity-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cognitoidp | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-cognitoidp-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-dynamodb | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-dynamodb-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-ec2 | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-ec2-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-ecr | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-ecr-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-ecs | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-ecs-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-efs | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-efs-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-eks | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-eks-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-elasticache | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-elasticache-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-firehose | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-firehose-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-iam | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-iam-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-kinesis | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-kinesis-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-kms | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-kms-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-lambda | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-lambda-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-memorydb | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-memorydb-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-rds | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-rds-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-rolesanywhere | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-rolesanywhere-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-route53 | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-route53-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-s3 | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-s3-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-servicediscovery | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-servicediscovery-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-sns | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-sns-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-sqs | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-sqs-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-ssm | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-ssm-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-aws-wafv2 | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-aws-wafv2-fips | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-family-aws | 0 | 2.5.0-r1 |
| Chainguard | crossplane-provider-family-aws-fips | 0 | 2.5.0-r2 |
| Chainguard | crossplane-provider-terraform | 0 | 1.1.1-r1 |
| Chainguard | crossplane-provider-terraform-fips | 0 | 1.1.1-r1 |
| Chainguard | cue | 0 | 0 |
| Chainguard | cue-fips | 0 | 0 |
| Chainguard | datadog-agent-7.71 | 0 | 7.71.2-r16 |
| Chainguard | datadog-agent-7.72 | 0 | 7.72.4-r16 |
| Chainguard | datadog-agent-7.74 | 0 | 7.74.1-r10 |
| Chainguard | datadog-agent-fips-7.73 | 0 | 7.73.3-r6 |
| Chainguard | datadog-cluster-agent-7.71 | 0 | 7.71.2-r16 |
| Chainguard | datadog-cluster-agent-7.72 | 0 | 7.72.4-r16 |
| Chainguard | datadog-cluster-agent-7.73 | 0 | 7.73.3-r8 |
| Chainguard | datadog-cluster-agent-7.74 | 0 | 7.74.1-r10 |
| Chainguard | datadog-cluster-agent-fips-7.73 | 0 | 7.73.3-r6 |
| Chainguard | deck | 0 | 1.57.0-r1 |
| Chainguard | deck-fips | 0 | 1.57.0-r1 |
| Chainguard | descheduler | 0 | 0.35.1-r1 |
| Chainguard | descheduler-fips | 0 | 0.35.1-r1 |
| Chainguard | dex | 0 | 2.45.1-r1 |
| Chainguard | dex-fips | 0 | 2.45.0-r1 |
| Chainguard | dogstatsd-7.71 | 0 | 7.71.2-r16 |
| Chainguard | dogstatsd-7.72 | 0 | 7.72.4-r16 |
| Chainguard | dogstatsd-7.73 | 0 | 7.73.3-r8 |
| Chainguard | dogstatsd-7.74 | 0 | 7.74.1-r10 |
| Chainguard | fleet-server-8.19 | 0 | 8.19.12-r1 |
| Chainguard | fleet-server-9.2 | 0 | 9.2.6-r1 |
| Chainguard | fleet-server-9.3 | 0 | 9.3.1-r1 |
| Chainguard | fleet-server-fips-8.19 | 0 | 8.19.12-r1 |
| Chainguard | fleet-server-fips-9.2 | 0 | 9.2.6-r1 |
| Chainguard | fleet-server-fips-9.3 | 0 | 9.3.1-r1 |
| Chainguard | flux-2.8 | 0 | 2.8.1-r3 |
| Chainguard | flux-fips-2.8 | 0 | 2.8.1-r2 |
| Chainguard | flux-kustomize-controller | 0 | 1.8.1-r1 |
| Chainguard | flux-kustomize-controller-fips | 0 | 1.8.1-r2 |
| Chainguard | flux-operator | 0 | 0.43.0-r2 |
| Chainguard | flux-operator-fips | 0 | 0.43.0-r0 |
| Chainguard | flux-operator-mcp | 0 | 0.43.0-r2 |
| Chainguard | flux-operator-mcp-fips | 0 | 0.43.0-r0 |
| Chainguard | flux-source-watcher | 0 | 2.1.0-r1 |
| Chainguard | flux-source-watcher-fips | 0 | 2.1.0-r1 |
| Chainguard | goose | 0 | 3.27.0-r1 |
| Chainguard | goose-fips | 0 | 3.27.0-r1 |
| Chainguard | goreleaser | 0 | 2.14.1-r2 |
| Chainguard | gotenberg | 0 | 8.27.0-r1 |
| Chainguard | grafana-alloy | 0 | 1.14.0-r1 |
| Chainguard | grafana-alloy-fips | 0 | 1.14.0-r1 |
| Chainguard | harbor-2.12 | 0 | 2.12.4-r33 |
| Chainguard | harbor-2.12-exporter | 0 | 2.12.4-r33 |
| Chainguard | harbor-2.12-jobservice | 0 | 2.12.4-r33 |
| Chainguard | harbor-2.12-registryctl | 0 | 2.12.4-r33 |
| Chainguard | harbor-2.13 | 0 | 2.13.5-r1 |
| Chainguard | harbor-2.13-exporter | 0 | 2.13.5-r1 |
| Chainguard | harbor-2.13-jobservice | 0 | 2.13.5-r1 |
| Chainguard | harbor-2.13-registryctl | 0 | 2.13.5-r1 |
| Chainguard | harbor-2.14 | 0 | 2.14.2-r12 |
| Chainguard | harbor-2.14-exporter | 0 | 2.14.2-r12 |
| Chainguard | harbor-2.14-jobservice | 0 | 2.14.2-r12 |
| Chainguard | harbor-2.14-registryctl | 0 | 2.14.2-r12 |
| Chainguard | harbor-fips-2.12 | 0 | 2.12.4-r30 |
| Chainguard | harbor-fips-2.12-exporter | 0 | 2.12.4-r30 |
| Chainguard | harbor-fips-2.12-jobservice | 0 | 2.12.4-r30 |
| Chainguard | harbor-fips-2.12-registryctl | 0 | 2.12.4-r30 |
| Chainguard | harbor-fips-2.13 | 0 | 2.13.5-r1 |
| Chainguard | harbor-fips-2.13-exporter | 0 | 2.13.5-r1 |
| Chainguard | harbor-fips-2.13-jobservice | 0 | 2.13.5-r1 |
| Chainguard | harbor-fips-2.13-registryctl | 0 | 2.13.5-r1 |
| Chainguard | harbor-fips-2.14 | 0 | 2.14.3-r1 |
| Chainguard | harbor-fips-2.14-exporter | 0 | 2.14.3-r1 |
| Chainguard | harbor-fips-2.14-jobservice | 0 | 2.14.3-r1 |
| Chainguard | harbor-fips-2.14-registryctl | 0 | 2.14.3-r1 |
| Chainguard | helm-diff | 0 | 3.15.1-r1 |
| Chainguard | helm-diff-fips | 0 | 3.15.1-r1 |
| Chainguard | hugo | 0 | 0 |
| Chainguard | hugo-extended | 0 | 0 |
| Chainguard | hugo-fips | 0 | 0 |
| Chainguard | karma | 0 | 0 |
| Chainguard | karma-fips | 0 | 0 |
| Chainguard | kube-logging-operator | 0 | 6.4.0-r2 |
| Chainguard | kube-rbac-proxy | 0 | 0.21.0-r1 |
| Chainguard | kube-rbac-proxy-fips | 0 | 0.21.0-r1 |
| Chainguard | kube-vip | 0 | 1.1.0-r1 |
| Chainguard | kube-vip-fips | 0 | 1.1.0-r1 |
| Chainguard | kubebuilder | 0 | 0 |
| Chainguard | kubo | 0 | 0.40.1-r1 |
| Chainguard | kubo-fips | 0 | 0.40.1-r1 |
| Chainguard | kyverno-policy-reporter | 0 | 3.7.3-r1 |
| Chainguard | kyverno-policy-reporter-fips | 0 | 3.7.3-r1 |
| Chainguard | linkerd2-cli | 0 | 26.2.1-r1 |
| Chainguard | linkerd2-controller | 0 | 26.2.1-r1 |
| Chainguard | linkerd2-fips-controller | 0 | 26.2.1-r1 |
| Chainguard | linkerd2-fips-metrics-api | 0 | 26.2.1-r1 |
| Chainguard | linkerd2-fips-tap | 0 | 26.2.1-r1 |
| Chainguard | linkerd2-fips-web | 0 | 26.2.1-r1 |
Related vulnerabilities
- CVE-2025-58190 The html.Parse function in golang.org/x/net/html has an infinite parsing loop when… Also affects golang.org/x/net
- CVE-2025-47911 The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when… Also affects golang.org/x/net
- CVE-2025-22870 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a… Also affects golang.org/x/net
- CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed… Also affects golang.org/x/net
- CVE-2023-45288 An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by… Also affects golang.org/x/net
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects golang.org/x/net
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects amazon-ssm-agent
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects amazon-ssm-agent