EUVD-2026-63660

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

EEF-CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836

CVE-2026-74836 is an unbounded resource exhaustion vulnerability in mtrudel/bandit (Erlang HTTP/2 server library), affecting versions 0.3.4 through before 1.12.5 . When a stream's response body exceeds the HTTP/2 connection-level send window (default 65,535 bytes), the stream process blocks indef...

PT-2026-79146

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.4 through 1.12.4 Description An unauthenticated remote attacker can pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting connection-level flow control. When a stream response body exceeds the HTTP/2...

CVE-2026-74836: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

The vulnerability of the rewrite mechanism (RewriteValve) of the Apache Tomcat application server allows a hacker to circumvent access control restrictions.

The vulnerability of the rewrite mechanism RewriteValve in the Apache Tomcat application server is related to the implementation of incorrect flow control. Exploiting this vulnerability allows a malicious actor to circumvent access control restrictions...

CVE-2026-66761

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66761 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66761 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66761

CVE-2026-66761: SAP Approuter in SAP Business AI Platform suffers from insufficient flow control allowing a low-privilege attacker to send large volumes of data, leading to unbounded memory growth and low availability impact. No impact on confidentiality or integrity is claimed. CVSS 3.1 base sco...

EUVD-2026-55879

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

PT-2026-70039

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to enforce sufficient flow control in certain functionality. A low-privileged attacker can send high volumes of data without consuming responses, leading to unbounde...

Vulnerability of JavaScript components: Firefox’s WebAssembly browser allows attackers to access sensitive data and compromise its integrity

JavaScript component vulnerability: Firefox’s WebAssembly browser is vulnerable due to the implementation of incorrect flow control. Exploiting this vulnerability could allow a remote attacker to access sensitive data and compromise its integrity...

Allocation of Resources Without Limits or Throttling

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through improper enforcement of the session flow control process. An attacker can cause resource exhaustion by sending dat...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the session flow control process. An attacker can cause resource exhaustion by sending messages that exceed the allowed incoming window. Remediation Upgrade Apache.Qpid.Proton to...