Rocky Linux 8 [CIQ] Security Update: java-21-openjdk / java-21-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_1828)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241828 advisory. OpenJDK: long Exception message leading to crash 8319851 CVE-2024-21011 OpenJDK: integer overflow in C1 compiler address generation 8322122 CVE-2024-21068...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging (crlsa-2023_5850)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235850 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_5869)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235869 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 A Rocky Enterprise Software Foundation Securi...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (crlsa-2023_5928)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235928 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc (crlsa-2023_5708)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235708 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-7.0 / aspnetcore-targeting-pack-7.0 / etc (crlsa-2023_5749)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235749 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-docs / etc (crlsa-2023_5765)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235765 advisory. nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 A Rocky Enterprise Software Foundation Securit...

Rocky Linux 9 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2023_5838)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235838 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2023_5924)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235924 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2023_6746)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20236746 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

GHSA-4MH8-R7RC-XPVC fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

EUVD-2026-80315

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses...

CLEANSTART-2026-GF82267 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-TQ18292 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the crane package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2025-ST85629 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service...

CLEANSTART-2025-AF65508 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service...

CLEANSTART-2025-JL64950 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy. The HTTP/2 path builds a session with...