The vulnerability in golang.org/x/net/http2 arises from a missing nil check that causes a server to panic when it receives HTTP/2 frames with types 0x0a through 0x0f. A panic triggers a crash of the running server instance, abruptly terminating service and resulting in a denial of service for all clients connected to that server. The vulnerability does not grant any attacker privilege escalation or data exposure, but it can be exploited remotely merely by sending the offending frames over an established HTTP/2 connection.

The affected component is the golang.org/x/net library, specifically the http2 package used by any Go application that implements HTTP/2 support. No specific software versions are listed; therefore, any application leveraging this library that has not applied the latest patch is potentially vulnerable.

With a CVSS score of 7.5, the risk level is moderate to high. The EPSS score indicates a very low likelihood of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, an attacker can trigger the panic by sending crafted HTTP/2 frames without authentication, making the vulnerability remotely exploitable with only network access to the server.