CLEANSTART-2026-DQ31365 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server)

CVE-2022-21628 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Lightweight HTTP Server. See references for individual vulnerability details...

CLEANSTART-2026-LJ66214 llhttp parser in the http module in Node v20

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

CLEANSTART-2026-BM42059 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the openjdk21 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-QW98383 Undici is an HTTP/1

Security vulnerability affects the openjdk21 package. Undici is an HTTP/1...

CVE-2025-55182-Lab

CVE-2025-55182 Lab A hands-on lab to exploit CVE-2025-55182 React2Shell - Remote Code Execution in React Server Components. ⚠️ Disclaimer Educational purposes only. Only test on systems you own. Quick Start Clone and start git clone https://github.com/dhananjayakumarn/CVE-2025-55182-Lab.git cd...

CLEANSTART-2026-QG19683 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-QI90513 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-GY77159 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-IE92648 client may issue specially crafted HTTP/1

Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

Envoy-CPU-Exhaustion-Vulnerability-PoC

Envoy CPU Exhaustion Vulnerability PoC This repository contains a proof-of-concept PoC Python script to demonstrate the CPU exhaustion vulnerability in Envoy caused by a flood of CONTINUATION frames. Author: blackmagic 2024 Description Envoy is a cloud-native, open-source edge and service proxy...

CVE-2025-4679-SecureOAuth-Demo---Enfoque-educativo

🔐 OAuth Security Laboratory: CVE-2025-4679 Educational Simulator A safe, isolated environment to learn about OAuth vulnerabilities without risking real systems 🚀 Quick Start | 📚 Learning Path | 🛡️ Safe Environment | 👥 Contributors 📖 Overview This educational laboratory simulates the CVE-2025-4679...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-server (UTSA-2026-130063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130063 advisory. RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service DoS...

PT-2026-114150

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http response recv that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized...

PT-2026-113982

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 and later Description Uncontrolled resource consumption allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely. By sending a trickle of small WINDOW UPDATE frames or empty SETTINGS frames, a...

The vulnerability of the Quarkus Java framework, related to incorrect interpretation of HTTP requests, allows attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of the Quarkus framework is related to incorrect interpretation of HTTP requests. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130138)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130138 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130122)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130122 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...