A malicious HTTP/2 peer can exhaust a client or server’s CPU by opening many streams and repeatedly sending small SETTINGS frames that alter the SETTINGS_INITIAL_WINDOW_SIZE. The result is a significant increase in processing load without advancing data transfer, effectively denying service. The weakness is a form of uncontrolled resource consumption flaw.

Go’s standard library packages net/http, net/http/internal/http2, and the golang.org/x/net/http2 package are affected. No specific version ranges are listed, so any deployment using these packages may be susceptible.

Because the vulnerability is triggered by crafted HTTP/2 traffic, the attack vector is network. The CVSS score is 7.5. The EPSS score is 0.227%, indicating a very low probability of exploitation observed publicly; however, the vulnerability is not listed in the CISA KEV catalog, and a low EPSS does not imply the issue is benign. Deployments that rely on HTTP/2 for client‑server communication could experience sudden CPU spikes if an attacker opens many streams or injects frequent SETTINGS frames. More detailed risk assessment should consider whether HTTP/2 is enabled and whether external traffic is restricted. The impact is potentially high, especially in environments where service availability is critical.