CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78659

An HTTP server is vulnerable to an asymmetric resource consumption attack via HTTP/2 "Trailer" headers. A malicious client can send a large number of fields within a "Trailer" header, forcing the server to allocate a disproportionate amount of memory because the Request.Trailer map incurs memory ...

CVE-2026-78659

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

GO-2026-6603 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

GO-2026-6617 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2025-8671-vulnerability-POC-

CVE-2025-8671-vulnerability-POC- CVE-2025-8671 ثغرة POC ماسح الثغرة CVE-2025-8671 أداة بحث أمنية احترافية لاكتشاف ثغرة MadeYouReset CVE-2025-8671 في خوادم HTTP/2. يستخدم هذا الماسح عدة استدلالات كشف لتحديد الخوادم المعرضة لهجمات التلاعب بمحاسبة التدفق. 🔍 حول CVE-2025-8671 تستغل ثغرة MadeYouReset...

CVE-2025-9784

CVE-2025-9784 MadeYouReset HTTP/2 Vulnerability Test Overview This repository contains a simple and effective bash script to test for the CVE-2025-9784 vulnerability known as the "MadeYouReset" HTTP/2 Denial of Service DoS attack in Undertow HTTP/2 server implementations. The vulnerability allows...

CVE_2023_44487-Rapid_Reset

Outil de Test HTTP/2 Rapid Reset CVE-2023-44487 - Édition Améliorée Un outil de test Python complet pour CVE-2023-44487 , la vulnérabilité HTTP/2 Rapid Reset. Cette version améliorée offre un contrôle granulaire des paramètres de test, plusieurs schémas d'attaque et des capacités de surveillance...

Apache-CVE-2026-23918-fix

Apache HTTP Server : http2 : Double Free et RCE possible lors d'un reset précoce CVE-2026-23918. Vulnérabilité de Double Free et de RCE possible dans Apache HTTP Server avec le protocole HTTP/2. Ce problème affecte Apache HTTP Server : 2.4.66. Il est recommandé aux utilisateurs de mettre à niveau...

CVE-2026-23918-Elite-Auditor

☣️ CVE-2026-23918-Elite-Auditor ☣️ Outil professionnel de renseignement et de reconnaissance pour la vulnérabilité de double libération double-free HTTP/2 d'Apache. 📌 Aperçu CVE-2026-23918 CVSS 8.8 est une faille critique de corruption mémoire dans Apache HTTP Server 2.4.66. Cet auditeur est conçu...

CVE-2026-23918

CVE-2026-23918 Scanner Apache HTTP/2 Ce dépôt contient un scanner Python simple et sûr à exécuter, conçu pour identifier les serveurs vulnérables à la CVE-2026-23918, une vulnérabilité critique de double libération double-free dans Apache HTTP/2. 🔍 Fonctionnalités clés Détection de version :...

CVE-2026-56848

CVE-2026-56848 Description NVD Une faille dans la gestion HTTP/2 de Node.js permet à nghttp2sessionmemsend d'être appelée de manière réentrante pendant que nghttp2sessionmemrecv est en cours d'exécution, ce qui entraîne un heap-use-after-free. Cette vulnérabilité affecte Node.js 26.x, 24.x et 22....

CVE-2023-44487

HTTP/2 Rapid Reset : CVE-2023-44487 Description Ce dépôt contient un code de preuve de concept PoC pour la vulnérabilité HTTP/2 Rapid Reset identifiée comme CVE-2023-44487. Aperçu de la vulnérabilité Identifiant CVE : CVE-2023-44487 Impact : Déni de service DoS Protocoles concernés : HTTP/2...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT : mélange de tunnel Code du programme simulation en C // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if...