Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Terraform Providers: Infinite Loop in HTTP/2 Transport

published 4 months ago

Summary

Updates are available for Terraform's local and null providers to prevent an infinite loop in HTTP/2 transport. This could allow a remote attacker to cause a denial-of-service attack. Users are advised to update to the latest version to ensure security.

What to do

Update suse terraform-provider-local to version 2.0.0-150200.6.14.1.
Update suse terraform-provider-null to version 3.0.0-150200.6.15.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
SUSE:Linux Enterprise Module for Public Cloud 15 SP4	suse	terraform-provider-local	< 2.0.0-150200.6.14.1 Fix: upgrade to 2.0.0-150200.6.14.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP4	suse	terraform-provider-null	< 3.0.0-150200.6.15.1 Fix: upgrade to 3.0.0-150200.6.15.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5	suse	terraform-provider-local	< 2.0.0-150200.6.14.1 Fix: upgrade to 2.0.0-150200.6.14.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5	suse	terraform-provider-null	< 3.0.0-150200.6.15.1 Fix: upgrade to 3.0.0-150200.6.15.1

Original advisory text

Security update for terraform-provider-local, terraform-provider-null

This update for terraform-provider-local, terraform-provider-null fixes the following issue

- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265658).

References

https://www.suse.com/support/update/announcement/2026/suse-su-20262484-1/ Vendor Advisory
https://bugzilla.suse.com/1265658 Third Party Advisory
https://www.suse.com/security/cve/CVE-2026-33814 URL

Timeline

Published22 Jun 2026

Updated24 Jun 2026

First seen24 Jun 2026

Sources

SUSE-SU-2026:2484-1 · OSV

Track software like this

Free during beta