Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2130)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2130 advisory. An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table...

EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2026-3342)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buff...

EulerOS 2.0 SP12 : haproxy (EulerOS-SA-2026-3267)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buff...

Alibaba Cloud Linux 3 : 0267: haproxy (ALINUX3-SA-2026:0267)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0267 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-55203: HAProxy through 3.4.0, fix...

Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

MGASA-2026-0349 Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

DoS (Denial of Service) at org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Crucible Data Center and Server

This High severity DoS Denial of Service vulnerability was introduced in version 4.9.0 of Crucible Server. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to cause a resource to...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

CVE-2026-54556

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

GHSA-VMM3-XGCX-67HM http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-54556

http4s (Scala HTTP library) versions prior to 0.23.35 and 1.0.0-M47 are vulnerable to an out-of-memory denial of service when using the Ember backend with HTTP/2 enabled. The root cause is a HPACK bomb : the Hpack wrapper concatenates HEADERS and CONTINUATION frame fragments into a single decoded...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

PT-2026-82110

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47 Description An unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend when HTTP/2 is enabled. The issue resides in the Hpack wrapper...

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper...

MiracleLinux 9 : haproxy-2.8.14-3.el9_8.2 (AXSA:2026-1627:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1627:03 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow i...