Vulnerability Report: GO-2026-4918

Affected Packages

• Path
  Versions
  Symbols
• golang.org/x/net/http2
  before v0.53.0
  • Transport.NewClientConn
  • Transport.RoundTrip
  • Transport.RoundTripOpt
• net/http
  before go1.25.10, from go1.26.0-0 before go1.26.3
  15 affected symbols

  • Client.CloseIdleConnections
  • Client.Do
  • Client.Get
  • Client.Head
  • Client.Post
  • Client.PostForm
  • ClientConn.Close
  • ClientConn.RoundTrip
  • Get
  • Head
  • Post
  • PostForm
  • Transport.CloseIdleConnections
  • Transport.NewClientConn
  • Transport.RoundTrip

Aliases

• CVE-2026-33814

References

• https://go.dev/cl/761581
• https://go.dev/cl/761640
• https://go.dev/issue/78476
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://vuln.go.dev/ID/GO-2026-4918.json

Credits

• Marwan Atia (marwansamir688@gmail.com)

Feedback