CLEANSTART-2026-YP03440 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-HD34144 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

AlmaLinux 8 : tomcat (ALSA-2026:92869)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92869 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

Security update for trivy (important)

openSUSE security update: security update for trivy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22178-1 Rating: important References: bsc1284829 bsc1285541 bsc1287329 Cross-References: CVE-2026-19585 CVE-2026-78669 CVE-2026-97032 CVSS scores:...

Security update for kubevirt1.9 (important)

openSUSE security update: security update for kubevirt1.9 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22180-1 Rating: important References: bsc1272840 bsc1285255 bsc1286984 bsc1287039 bsc1287143 bsc1287446 Cross-References: CVE-2026-13622...

Security update for cadvisor (important)

openSUSE security update: security update for cadvisor ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22200-1 Rating: important References: bsc1285500 bsc1287575 Cross-References: CVE-2026-78669 CVE-2026-97032 CVSS scores: CVE-2026-78669 SUSE : 7.5...

RockyLinux 8 : tomcat (RLSA-2026:92869)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92869 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

Security update for coredns (important)

openSUSE security update: security update for coredns ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22194-1 Rating: important References: bsc1285501 bsc1287577 Cross-References: CVE-2026-78669 CVE-2026-97032 CVSS scores: CVE-2026-78669 SUSE : 7.5...

CVE-2026-42945-NGINX-Rift-Toolkit

CVE-2026-42945 Nginx Rift Vulnerability Toolkit Comprehensive toolkit for scanning, patching, and testing CVE-2026-42945 - a critical RCE vulnerability in nginx Table of Contents Overview CVE Details Features Toolkit Components Requirements Installation Usage Workflow Examples Security...

http2-bomb

HTTP/2 Bomb — CVE-2026-49975 HTTP/2 Stream Amplification PoC · Docker · Web Console Vulnerability HTTP/2 allows multiplexing multiple streams over a single TCP connection. This PoC crafts specially formed HEADERS frames containing a large number of internal references, forcing the server to...

CVE-2026-56848

CVE-2026-56848 NVD Description A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x. Note: versions mentioned in the descriptio...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

CVE-2026-32136_exploit

CVE-2026-32136exploit - AdGuard Home h2c Upgrade Auth Bypass Unauthenticated authentication bypass in AdGuard Home 0.107.73 via HTTP/2 cleartext h2c upgrade. | ---|--- CVE| CVE-2026-32136 CVSS| 9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-287 Improper Authentication Affected| AdGua...

CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit

CVE-2023-44487 HTTP/2 DoS Rapid Reset Exploit Professional Edition v1.0.1 | Author: Sudeepa Wanigarathna -orange.svg Table of Contents Overview Vulnerability Details Features Requirements Installation Quick Start Usage Guide Configuration Options Docker Support Examples Understanding Results...

CVE-2026-86350

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-86350 Write-up: https://abraxaslabs.tech/research/CVE-2026-86350 CVE-2026-86350 Apache Tomcat 9.0.121 - Apache Software Foundation I am @abraxasnull. Loopback lab. The client is CVE-2026-86350-Abraxas-Labs.py...

MadeYouReset_Tester

MadeYouReset Checker A lightweight Python script to detect whether a web server is potentially vulnerable to the MadeYouReset HTTP/2 denial-of-service vulnerability — tracked as CVE-2025-8671 CVSS 7.5 High. Background MadeYouReset is an HTTP/2 DoS vulnerability disclosed in August 2025 by...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

CLEANSTART-2026-WS65810 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the prometheus-pushgateway-fips package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2024-YV74976 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Security vulnerability affects the go package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...

CLEANSTART-2024-RF99402 attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

Security vulnerability affects the go package. An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests...