93 matches found
CVE-2026-71418
A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple craft...
io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...
SUSE SLES15 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4206-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4206-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128....
GO-2026-6348 Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc
Heap Memory Exhaustion OOM via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc...
Astra Linux – Vulnerability in Jetty9
In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, and =12.1.0alpha2, an HTTP/2 client may trigger the server to send RSTSTREAM frames. This can happen by sending frames that are malformed or should not be sent under certain stream states, thereby forcing the server to consume...
io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...
CVE-2026-84304: Uncontrolled Resource Consumption
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
BIT-ELK-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
PT-2026-80654
Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...
CVE-2026-72671
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
CVE-2026-73568
py-libp2p (Python implementation of libp2p) before 0.7.0 has a yamux handle_incoming() flaw in libp2p/stream_muxer/yamux/yamux.py: it reads a 32-bit DATA frame length with read_exactly() before validating against MAX_WINDOW_SIZE or checking stream_id. A peer completing the Noise handshake can sen...
CVE-2026-72671: Missing Authorization
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
CVE-2026-73568: Uncontrolled Resource Consumption
py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handleincoming method in libp2p/streammuxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with readexactly before validating it against MAXWINDOWSIZE or checking whether...
PT-2026-71781
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description A Kibana Machine Learning capability that removes a saved object from the current space incorrectly verifies privileges when targeting machine learning trained models. It only checks for...
io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...
DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bamboo Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows a...
