58 matches found
CVE-2025-8671
CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Author : @abiyeenzo ⚠️ Warning This project is provided for educational purposes only. Running the PoC against third-party servers may constitute an illegal cyberattack and lead to criminal prosecution. Only use this script on your test environments or local...
EUVD-2026-79632
Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...
Http4s Ember HTTP/2: unbounded continuation frame accumulation
When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...
CVE-2026-49975
CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...
CVE-2026-49975
CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
Tomcat-CVE-2025-31650
CVE-2025-31650 🚨 Prueba de Concepto PoC para la vulnerabilidad DoS HTTP/2 en Apache Tomcat CVE-2025-31650 Este script provoca una condición de agotamiento de memoria en Apache Tomcat enviando cabeceras priority malformadas a través de HTTP/2. 🎯 Versiones Afectadas Apache Tomcat 9.0.76 – 9.0.102...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090126)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090126 advisory. Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window ...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
Important: nginx
Issue Overview: An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table with a header, then emit thousands of indexed references that each cost significa...
Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2130)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2130 advisory. An HTTP/2 denial of service vulnerability was found in nginx. Prior to the fix, there was no limit on the number of request headers a client could send. An attacker could seed the HPACK dynamic table...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.7
Red Hat OpenShift Service Mesh 3.3.7 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.3....
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.9
Red Hat OpenShift Service Mesh 3.2.9 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.2....
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.12
Red Hat OpenShift Service Mesh 3.1.12 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.15
Red Hat OpenShift Service Mesh 3.0.15 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...
grafana-pcp security update
An update is available for grafana-pcp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Grafana plugin for Performance Co-Pilot includes datasources for...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...