Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...

CVE-2026-59762: Allocation of Resources Without Limits or Throttling

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...

AZL-92402 CVE-2026-15713 affecting package libsoup 3.4.4-16

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

CVE-2026-15713

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

CVE-2026-48068

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in...

AZL-92409 CVE-2026-15712 affecting package libsoup 3.4.4-16

A heap buffer over-read vulnerability was discovered in libsoup's versions: libsoup 3.0 to 3.7.0 HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminate...

nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...

nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service...

CVE-2026-15712: Out-of-bounds Read

A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser...

CVE-2026-49788: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network...

CVE-2026-15713: Missing Release of Resource after Effective Lifetime

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

CVE-2026-59246: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP2.handlecontinuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2...

CVE-2026-6790: Improper Input Validation

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-48068: Uncaught Exception

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in...

CVE-2026-15713: Missing Release of Resource after Effective Lifetime

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

CVE-2026-15712: Out-of-bounds Read

A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser...

RHEL 8 : nginx:1.24 (RHSA-2026:38847)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38847 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...