nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

Important: Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

An update for nodejs24 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

BIT-TOMCAT-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at...

CVE-2026-49975-HTTP-2-Bomb

Un outil de tri pas d'exploitation pour identifier les surfaces d'attaque exposées à CVE-2026-49975 — "Bombe HTTP/2". ⚠️ Ce script n'envoie pas de charges d'attaque. Il effectue uniquement des requêtes HTTP normales et analyse les en-têtes de réponse pour signaler les hôtes qui nécessitent une...

http2-bomb-detector

http2-bomb-detector Détecteur non destructif de vulnérabilité HTTP/2 Bomb CVE-2026-49975 — pour Nginx / Apache httpd Contexte de la vulnérabilité CVE-2026-49975 est une vulnérabilité de déni de service à distance affectant largement la couche de protocole HTTP/2, découverte par le chercheur en...

CVE-2026-49975

CVE-2026-49975 Bombe HTTP/2 ★ CVE-2026-49975 PoC de la Bombe HTTP/2 ★ Aperçu CVE-2026-49975 est une vulnérabilité Denial of Service DoS dans Apache HTTP Server. La vulnérabilité se produit dans le chemin de traitement des requêtes HTTP/2, où plusieurs champs d'en-tête cookie peuvent être fusionné...

CVE-2026-33186

CVE-2026-33186 Contournement de la politique d'autorisation RBAC gRPC-Go via un slash manquant dans :path Bypass d'authentification Description Le paquet authz dans google.golang.org/grpc implémente l'autorisation RBAC au niveau du SDK en utilisant des règles de refus deny et d'autorisation allow...

CVE-2023-44487-dos

CVE-2023-44487 HTTP/2 Rapid Reset Il y a quelques exemples dans ce dépôt qui ne sont pas entièrement testés pour analyser l'impact, mais je voulais juste mettre en œuvre le concept de cette attaque ouvrir de nombreux flux et envoyer immédiatement une trame RSTSTREAM pour éviter d'atteindre...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

CVE-2026-49975

CVE-2026-49975 Bombe HTTP/2 PoC Outil de reproduction de la vulnérabilité de déni de service distant HTTP/2 Présentation de la vulnérabilité CVE-2026-49975 est une vulnérabilité de déni de service HTTP/2 affectant les principaux serveurs Web. Elle a été découverte début juin 2026 par la société d...

CVE-2026-49975

CVE-2026-49975 Инструмент для воспроизведения HTTP/2 Bomb Автор : polar bear Версия : 2.1 Уязвимость : CVE-2026-49975 бомба памяти протокола HTTP/2 📖 Принцип уязвимости CVE-2026-49975 — это уязвимость истощения памяти в реализации протокола HTTP/2. Цепочка атаки включает два ключевых шага: 1...

CVE-2025-8671-MadeYouReset-HTTP-2-DDoS

HTTP/2 DDoS Heuristic Tester Tests automatiques pour détecter heuristiquement la présence de vulnérabilités dans HTTP/2 associées à des attaques DDoS : Développé par m10sec. CVE-2023-44487 – Rapid Reset CVE-2025-8671 – MadeYouReset Comparaison combinée Inclut menu interactif , exécution via CLI ,...

CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC

CVE-2023-44487 - HTTP/2 Rapid Reset Checker PoC Описание Данный скрипт представляет собой доказательство концепции Proof of Concept, PoC для CVE-2023-44487 , также известной как атака быстрого сброса HTTP/2 HTTP/2 Rapid Reset Attack. Уязвимость позволяет злоумышленникам выполнять атаку типа «отка...

CVE-2026-49975

CVE-2026-49975 Bombe HTTP/2 ★ CVE-2026-49975 PoC de la Bombe HTTP/2 ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Aperçu CVE-2026-49975 est une vulnérabilité de déni de service DoS dans le serveur Apache HTTP. La vulnérabilité se produit dans le chemin de...

ALSA-2026:61386 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

RockyLinux 9 : nodejs:22 (RLSA-2026:61383)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61383 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...