CVE-2026-75484

CVE-2026-75484 is a CRLF injection vulnerability in mtrudel bandit (Elixir HTTP server), versions 1.4.0 through before 1.12.5 . The root cause is in Bandit.HTTP2.Stream.read_headers/1, which validates header structure but never inspects field values . Because HPACK carries arbitrary octets, an un...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

EEF-CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Summary Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read\headers/1 validates pseudo-header placeme...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

EUVD-2026-63660

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

EEF-CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836

CVE-2026-74836 is an unbounded resource exhaustion vulnerability in mtrudel/bandit (Erlang HTTP/2 server library), affecting versions 0.3.4 through before 1.12.5 . When a stream's response body exceeds the HTTP/2 connection-level send window (default 65,535 bytes), the stream process blocks indef...

grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote...

PT-2026-79146

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.4 through 1.12.4 Description An unauthenticated remote attacker can pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting connection-level flow control. When a stream response body exceeds the HTTP/2...

Linux Distros Unpatched Vulnerability : CVE-2026-75144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to...

PT-2026-79147

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 through 1.12.4 Description An improper neutralization of CRLF sequences allows an unauthenticated remote attacker to smuggle Carriage Return CR, Line Feed LF, or Null NUL characters into application-visible request header...

Security update for ctop (important)

openSUSE Security Update: Security update for ctop Announcement ID: openSUSE-SU-2026:0292-1 Rating: important References: 1248710 1257431 1265800 1266632 1267805 Cross-References: CVE-2022-21698 CVE-2024-45310 CVE-2026-10722 CVE-2026-33814 CVE-2026-39821 CVSS scores: CVE-2022-21698 SUSE: 7.5...

GHSA-RXJR-6C9Q-H67X

creationtimestamp| type| source ---|---|--- 2026-08-19 21:16:30+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mthnpgazgt2v...

CVE-2026-47219

A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause the application to crash, leading to a Denial of Service...

CVE-2026-75144

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75144 FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

EUVD-2026-62581

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75144

CVE-2026-75144 is a heap buffer overflow in FFmpeg 's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c). The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, allowing memory corruption when a crafted Dirac data unit is packe...