[CRITICAL] Patch etcd for CVE-2026-39821 (#17529)

Co-authored-by: AkarshHCL <v-akarshc@microsoft.com>
Co-authored-by: Sumit Jena <v-sumitjena@microsoft.com>
(cherry picked from commit a4f5fae)

Author: 3 people

SPECS/etcd/CVE-2026-33814.patch

@@ -0,0 +1,42 @@
+From 7e9e82f8c3033974b16d93835521f6e133a7c9aa Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Thu, 14 May 2026 09:00:37 +0000
+Subject: [PATCH] http2: prevent hanging Transport due to bad SETTINGS frame
+
+This CL backports https://go.dev/cl/761581 to x/net.
+
+Fixes golang/go#78476
+Fixes CVE-2026-33814
+
+Upstream-reference: https://github.com/golang/net/commit/1e71bd86e4a302b4e731bc06da6eb51679c7bd49.patch
+---
+ vendor/golang.org/x/net/http2/transport.go | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
+index 8cf64b7..3b514a3 100644
+--- a/vendor/golang.org/x/net/http2/transport.go
++++ b/vendor/golang.org/x/net/http2/transport.go
+@@ -2865,6 +2865,9 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
+ 
+ 	var seenMaxConcurrentStreams bool
+ 	err := f.ForeachSetting(func(s Setting) error {
++		if err := s.Valid(); err != nil {
++			return err
++		}
+ 		switch s.ID {
+ 		case SettingMaxFrameSize:
+ 			cc.maxFrameSize = s.Val
+@@ -2896,9 +2899,6 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
+ 			cc.henc.SetMaxDynamicTableSize(s.Val)
+ 			cc.peerMaxHeaderTableSize = s.Val
+ 		case SettingEnableConnectProtocol:
+-			if err := s.Valid(); err != nil {
+-				return err
+-			}
+ 			// If the peer wants to send us SETTINGS_ENABLE_CONNECT_PROTOCOL,
+ 			// we require that it do so in the first SETTINGS frame.
+ 			//
+-- 
+2.45.4
+