Incomplete Cleanup

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete cleanup in the HTTP/2 trailer header process. An attacker can access sensitive information from previous requests by sending...

Incomplete Cleanup

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete cleanup in the HTTP/2 trailer header process. An attacker can access sensitive information from previous requests by sending...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

SUSE CVE-2026-88004

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-92081

fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...