28493 matches found
tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak
A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...
BIT-TOMCAT-2026-78437 Apache Tomcat: HTTP/2 DoS via malformed request
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...
BIT-TOMCAT-2026-77762 Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.39...
BIT-RABBITMQ-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...
BIT-RABBITMQ-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...
BIT-RABBITMQ-2026-67223 RabbitMQ: LDAP DN injection via unescaped substitution
RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...
BIT-RABBITMQ-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...
CLEANSTART-2024-LA03000 In GIMP 2
Security vulnerability affects the gimp package. In GIMP 2...
CLEANSTART-2024-II94239 In GIMP 2
Security vulnerability affects the gimp package. In GIMP 2...
CLEANSTART-2024-QZ64371 In GIMP 2
Security vulnerability affects the gimp package. In GIMP 2...
CLEANSTART-2024-VI87250 In GIMP 2
Security vulnerability affects the gimp package. In GIMP 2...
CLEANSTART-2023-WW67500 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2
Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...
CLEANSTART-2023-DB74273 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2
Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...
CLEANSTART-2023-NE75380 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2
Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...
CLEANSTART-2023-VR99573 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2
Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...
CLEANSTART-2023-LH87514 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2
Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...
CLEANSTART-2024-PI41576 In Wireshark 2
Security vulnerability affects the drupal7 package. In Wireshark 2...
CLEANSTART-2026-HC06922 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
Security vulnerability affects the exoscale package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...
CLEANSTART-2025-MG51423 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023
CVE-2023-44487 affects multiple packages. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. See references for individual vulnerability details...
CLEANSTART-2026-CN84558 attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames
Security vulnerability affects the cri-tools package. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames...