Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.14 security and extras update

Red Hat OpenShift Container Platform release 4.22.14 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

[SECURITY] Fedora 43 Update: perl-Protocol-HTTP2-1.14-1.fc43

Protocol::HTTP2 is Perl HTTP/2 protocol implementation RFC 7540 with stateful decoders/encoders of HTTP/2 frames. You may use this module to implement your own HTTP/2 client/server/intermediate on top of your favorite event loop over plain or TLS socket...

[SECURITY] Fedora 44 Update: perl-Protocol-HTTP2-1.14-1.fc44

Protocol::HTTP2 is Perl HTTP/2 protocol implementation RFC 7540 with stateful decoders/encoders of HTTP/2 frames. You may use this module to implement your own HTTP/2 client/server/intermediate on top of your favorite event loop over plain or TLS socket...

[SECURITY] Fedora 45 Update: perl-Protocol-HTTP2-1.14-1.fc45

Protocol::HTTP2 is Perl HTTP/2 protocol implementation RFC 7540 with stateful decoders/encoders of HTTP/2 frames. You may use this module to implement your own HTTP/2 client/server/intermediate on top of your favorite event loop over plain or TLS socket...

CVE-2026-69218: Allocation of Resources Without Limits or Throttling

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

CVE-2026-19773: Out-of-bounds Write

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw...

PT-2026-92421

Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body...

CVE-2026-83276: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

PT-2026-92422

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGS MAX CONCURRENT STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting...

PT-2026-92802

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webserver-http2 component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a...

CVE-2026-88975: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGSMAXFRAMESIZE. An unauthenticated peer can declare a payload near 16 MiB on a...

PT-2026-92473

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.37 Http4s versions prior to 1.0.0-M48 Description An issue exists in Ember's HTTP/2 read loop where the system parses a frame's 24-bit declared length but buffers the entire payload before comparing it with SETTIN...

PT-2026-92428

When Ember receives an HTTP/2 HEADERS or PUSH PROMISE frame without the END HEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any...

PT-2026-92405

Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber writeLoop. When the write side stalls, any frames the connection keeps producing accumulate in that queue without limit. The peer can drive this cheaply because the connection emi...

CVE-2026-69202: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

nginx:1.24 security update

1.24.0-7.5.0.1 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 1:1.24.0-7.5 - Resolves: RHEL-212508 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 1:1.24.0-7.4 - Resolves: RHEL-219310 - nginx:...

nginx:1.26 security update

1.26.3-9.4.0.1 - Require oracle-indexhtml 2:1.26.3-14 - Fixes CVE-2026-42533 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Servic...

PT-2026-92798

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webclient-http2 component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a...

CVE-2026-83280: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-69213: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause...