Security readout for executives and security teams
Plain-English summary
CVE-2026-27141 is a denial-of-service flaw in Go’s HTTP/2 library. A remote, unauthenticated client can send certain HTTP/2 frames that make an affected server panic. The reported impact is availability loss, not data theft or code execution.
Executive priority
Treat this as a high-priority availability risk for Go-based HTTP/2 services. It is not described as data compromise, but a remote crash condition can affect customer-facing uptime. Focus first on exposed services using the affected module version.
Technical view
The issue is a missing nil check in golang.org/x/net/http2. Version 0.50.0 is listed as affected. HTTP/2 frame types 0x0a through 0x0f can trigger a server panic. CVSS 3.1 is 7.5: network reachable, low complexity, no privileges, no user interaction, availability impact only.
Likely exposure
Exposure is likely for Go services using golang.org/x/net/http2 version 0.50.0 and accepting HTTP/2 traffic from untrusted clients. Internet-facing APIs, proxies, and services behind HTTP/2-capable load balancers should be prioritized for review.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The vulnerability appears simple to reach over the network where HTTP/2 is enabled, but the documented outcome is process panic and service disruption.
Researcher notes
Evidence identifies CWE-476 and a missing nil check in x/net/http2. The provided data names version 0.50.0 as affected but does not include a fixed version. Avoid assuming broader Go standard-library impact unless confirmed by Go’s advisory or NVD updates.
Mitigation direction
- Inventory Go services using golang.org/x/net/http2.
- Identify deployments using golang.org/x/net/http2 version 0.50.0.
- Check the Go vulnerability advisory and linked change for remediation guidance.
- Update the affected module when vendor guidance identifies a safe version.
- Prioritize internet-facing HTTP/2 services for remediation or compensating controls.
Validation and detection
- Review dependency manifests and SBOMs for golang.org/x/net/http2 0.50.0.
- Confirm whether the service accepts HTTP/2 from untrusted networks.
- Check crash logs for HTTP/2-related panics.
- Use Go vulnerability tooling or advisory data to confirm affected modules.
- Verify remediation against the Go advisory once fixed-version details are available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27141 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://nvd.nist.gov/vuln/detail/CVE-2026-27141CVE reference
- https://go.dev/cl/746180CVE reference
- https://go.dev/issue/77652CVE reference
- https://pkg.go.dev/vuln/GO-2026-4559CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.