491 matches found
CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804
The OpenSSL QUIC stack fails to enforce connection-level flow control for streams, a vulnerability categorized as CWE-770 . While the stack validates stream-level limits, it neglects connection-level limits, allowing a remote peer to send more bytes than permitted by the connection window as long...
EUVD-2026-89009
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
http2-bomb-detector
http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 非破壊的脆弱性検出ツール — Nginx / Apache httpd 向け 脆弱性の背景 CVE-2026-49975 は、広範囲に影響を及ぼす HTTP/2 プロトコル層のリモートサービス拒否脆弱性であり、セキュリティ研究者の Quang Luong によって発見されました。この脆弱性は HPACK ヘッダー圧縮 と フロー制御メカニズム の組み合わせによる設計上の欠陥を悪用し、攻撃者は認証なしで 10～20 秒以内にサーバーの 32GB メモリを枯渇させることができます。 CVSS 3.1...
CVE-2026-49975
CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 リモートサービス拒否脆弱性再現ツール 脆弱性の概要 CVE-2026-49975 は、主要な Web サーバーに影響する HTTP/2 サービス拒否（DoS）脆弱性です。この脆弱性は、セキュリティ企業 Calif（OpenAI Codex を使用）によって 2026 年 6 月上旬に発見されました。 攻撃原理 1. HPACK 圧縮爆弾 ：極めて小さなヘッダー（例: "x: a"）をサーバーの HPACK 動的テーブルに挿入し、その後 1...
UBUNTU-CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
PT-2026-102654
Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description The QUIC stack fails to enforce connection-level flow control for streams, although it correctly enforces stream-level limits. A remote peer can bypass the intended connection flow control...
Linux Distros Unpatched Vulnerability : CVE-2026-75804
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the...
QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804: Allocation of Resources Without Limits or Throttling
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
CVE-2026-75804: Allocation of Resources Without Limits or Throttling
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
http2-bomb-analysis-paper
HTTP/2 Bomb：HPACK インデックス参照増幅チェーン攻撃 高校生による自主的な技術詳細調査 2026年6月 TL;DR このリポジトリには、20年近く前から存在する2つのHTTP/2プリミティブを連鎖させるHTTP/2 Bomb 脆弱性（CVE-2026-49975 / CVE-2026-47774）に関する完全な分析を掲載しています： HPACK インデックス参照増幅 – ほぼ空の動的テーブルエントリに対して数千の1バイト参照を送信する フロー制御ウィンドウの停滞 – 初期ウィンドウをゼロにし、定期的に1バイトのWINDOWUPDATEを送信してメモリを永遠に固定する 結果...
CLEANSTART-2026-ZS57953 authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service
CVE-2026-66275 affects multiple packages. An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. See references for individual vulnerability details...
