CVE-2026-49975

CVE-2026-49975 HTTP/2 炸弹 ★ CVE-2026-49975 HTTP/2 炸弹 PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 概述 CVE-2026-49975 是 Apache HTTP Server 中的一个 拒绝服务（DoS） 漏洞。 该漏洞出现在 HTTP/2 请求处理路径中，多个 cookie 头部字段可能被合并，而未被正确计入 LimitRequestFields 限制。 通过发送一个经过 HPACK 编码的小型 HTTP/2...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC Strumento di riproduzione della vulnerabilità di denial of service remota HTTP/2 Panoramica della vulnerabilità CVE-2026-49975 è una vulnerabilità di denial of service HTTP/2 che colpisce i principali server web. È stata scoperta all'inizio di giugno 2026 dalla...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Autor : @abiyeenzo ⚠️ Aviso Este projeto é fornecido apenas para fins educacionais. A execução do PoC contra servidores de terceiros pode constituir um ataque informático ilegal e resultar em sanções penais. Utilize este script apenas em seus ambientes de...

Tomcat-CVE-2025-31650

CVE-2025-31650 🚨 Prova di concetto PoC per la vulnerabilità DoS HTTP/2 di Apache Tomcat CVE-2025-31650 Questo script causa una condizione di esaurimento della memoria in Apache Tomcat inviando header priority malformati su HTTP/2. 🎯 Versioni interessate Apache Tomcat 9.0.76 – 9.0.102 Apache Tomca...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

RHEL 9 : mod_http2 (RHSA-2026:55930)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55930 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...

GLSA-202608-05 : Apache HTTPD: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-05 Apache HTTPD: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

EUVD-2026-55825

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

Photon OS 5.0: Nghttp2 PHSA-2026-5.0-92-0802

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0802. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69958

Name of the Vulnerable Software and Affected Versions ml-metadata affected versions not specified Description An outdated statically-linked gRPC stack in ml-metadata is susceptible to HTTP/2 denial of service DoS issues. An attacker with network access to the MLMD pod can send specially crafted...

@0x0.bug/pi-coding-agent (1.0.0), @0xwork/connect (>=0.1.0, <=0.1.9) +1195 more potentially affected by CVE-2026-14643 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =2026.6.2, =2026.6.5 and more Source cves: CVE-2026-14643 Source...

RHEL 10 : mod_http2 (RHSA-2026:22528)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:22528 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: Apache HTTP...

RLSA-2026:22551 Moderate: mod_http2 security update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

Important: Red Hat Security Advisory: nghttp2 security update

An update for nghttp2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

MiracleLinux 8 : tomcat-9.0.87-1.el8_10.4 (AXSA:2025-10519:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10519:03 advisory. tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation CVE-2024-56337 tomcat: Apache Tomcat: DoS via malformed HTTP...