104 matches found
EUVD-2026-72165
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...
CVE-2026-18924
CVE-2026-18924 affects libcurl versions 7.44.0 through 8.21.x , fixed in 8.22.0 . The vulnerability is a use-after-free in the cleanup process when handling HTTP/2 Server Push streams, triggered specifically when the parent handle is configured to share connections with other handles. A HackerOne...
CVE-2026-18924 HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...
libcurl 7.44.0 < 8.22.0 HTTP/2 Server Push Use-After-Free
The version of libcurl installed on the remote host is 7.44.0 prior to 8.22.0. It is, therefore, affected by a use-after-free vulnerability: - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to...
HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...
CURL-CVE-2026-18924 HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...
PT-2026-84651
Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw exists in the handling of HTTP/2 Server Push streams. When the parent handle is configured to share connections with other handles, a use-after-free condition can occur during the...
Astra Linux – Vulnerability in Node.js
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerabili...
curl: CVE-2026-18924: HTTP/2 server push UAF
A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed...
openSUSE 16 Security Update : libsoup (openSUSE-SU-2026:20845-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20845-1 advisory. This update for libsoup fixes the following issue - CVE-2026-4271: use-after-free in the HTTP/2 server when user signal handlers disconnect connections...
Security update for libsoup (important)
openSUSE security update: security update for libsoup ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20845-1 Rating: important References: bsc1259767 Cross-References: CVE-2026-4271 CVSS scores: CVE-2026-4271 SUSE : 8.6...
OPENSUSE-SU-2026:20845-1 Security update for libsoup
This update for libsoup fixes the following issue - CVE-2026-4271: use-after-free in the HTTP/2 server when user signal handlers disconnect connections during callback execution bsc1259767...
JLSEC-2026-416 When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received...
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit 1000, libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead lea...
Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1404)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1404 advisory. Bypass File System Permissions using crafted symlinks CVE-2025-55130 A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using th...
EUVD-1999-1211
Malware in sbrugna...
EUVD-1999-1210
Malware in sbrugna...
EUVD-2025-10901
Malicious code in bioql PyPI...
EUVD-2022-6436
Malicious code in bioql PyPI...