CLEANSTART-2026-VJ41449 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

CVE-2019-9512 affects multiple packages. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. See references for individual vulnerability details...

CLEANSTART-2026-HO16280 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

CVE-2023-44487 affects multiple packages. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. See references for individual vulnerability details...

CLEANSTART-2024-SH93448 Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request

Security vulnerability affects the varnish package. Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request...

CLEANSTART-2024-VD19714 Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames

Security vulnerability affects the trafficserver9 package. Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames...

CLEANSTART-2026-KE78760 maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests

CVE-2022-41723 affects multiple packages. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. See references for individual vulnerability details...

CLEANSTART-2026-NZ99121 attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

CVE-2022-41717 affects multiple packages. An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. See references for individual vulnerability details...

CLEANSTART-2026-EK17939 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node

Security vulnerability affects the nodejs package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...

CLEANSTART-2026-WA79724 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-WQ73692 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Security vulnerability affects the gatekeeper package. Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic...

CVE2026-42926

CVE-2026-42926 NGINX HTTP/2 Frame Injection Lab A controlled cybersecurity lab for validating and comparing behavior related to CVE-2026-42926 , an HTTP/2 frame injection issue affecting specific NGINX versions when a vulnerable proxy configuration is used. This repository is intended for defensi...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Description This repository contains proof-of-concept PoC code for the HTTP/2 Rapid Reset vulnerability identified as CVE-2023-44487. Vulnerability Overview CVE ID : CVE-2023-44487 Impact : Denial of Service DoS Affected Protocols : HTTP/2 Affected Components :...

CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

CLEANSTART-2026-ED38277 malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption

Security vulnerability affects the nodetaint package. A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption...

RLSA-2026:92869 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

CLEANSTART-2026-GW34771 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-IL62744 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

CVE-2026-54428 affects multiple packages. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5. See references for individual vulnerability details...

CLEANSTART-2026-RN43257 mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource con...

Security vulnerability affects the apache-nifi package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

CVE-2026-23918-Passive-Audit

CVE-2026-23918 audit script alternatively you could just curl the headers and take a peek, but here comes the: Non-invasive HTTP metadata auditor for Apache HTTP Server CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 exposure triage. The tool sends ordinary HTTP HEAD/GET...