CLEANSTART-2026-QS58056 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

CVE-2023-44487 affects multiple packages. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. See references for individual vulnerability details...

CLEANSTART-2026-WI32496 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

CVE-2026-27141 affects multiple packages. Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic See references for individual vulnerability details...

Security Bulletin: multiple vulnerabilities addressed in IBM Concert Network Observability

Summary IBM Concert Network Observability has addressed multiple security vulnerabilities through a Network Collectors update. Vulnerability Details CVEID:CVE-2026-78659 DESCRIPTION: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the...

CVE-2026-19773

A flaw was found in libwebsockets. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution by sending specially crafted HTTP/2 network traffic. The issue occurs due to improper input validation during the parsing of path headers compressed with HPACK a...

CLEANSTART-2026-JM07565 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CVE-2025-31650

Apache Tomcat 10.1.39 - Denial of Service DoS This tool performs a high-volume, asynchronous HTTP/2 request flood using malformed priority headers to test the stability of Apache Tomcat servers running version 10.1.10 to 10.1.39. ⚠️ This is strictly for educational and research purposes only. ❌ Th...

SUSE-SU-2026:4954-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-11856: cross-origin Digest auth state leak bsc1268426. - CVE-2026-18924: HTTP/2 server push UAF bsc1277477. - CVE-2026-19931: Negotiate ambient user conn reuse...

CLEANSTART-2026-KZ33955 attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

Security vulnerability affects the litestream package. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames...

CLEANSTART-2026-HA85084 malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption

CVE-2023-39325 affects multiple packages. A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. See references for individual vulnerability details...

CLEANSTART-2026-WJ31300 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the cassandra-reaper-fips package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

CLEANSTART-2026-SH36896 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the cassandra-reaper-fips package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

external_curl_AOSP10_r33_CVE-2021-22924

| | | | | | / | | | | | | | | | || | | | |/|| \| README Curl is a command line tool for transferring data specified with URL syntax. Find out how to use curl by reading the curl.1 man page or the MANUAL document. Find out how to install Curl by reading the INSTALL document. libcurl is the...

CLEANSTART-2026-ZA31794 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Author : @abiyeenzo ⚠️ Warning This project is provided for educational purposes only. Running the PoC against third-party servers may constitute an illegal cyberattack and lead to criminal prosecution. Only use this script on your test environments or local...

CLEANSTART-2026-JG21466 mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource con...

Security vulnerability affects the cassandra-reaper-fips package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to...

Analysis-of-TomcatKiller---CVE-2025-31650-Exploit-Tool

Tomcat Vulnerability Scanner A tool to detect CVE-2025-31650 in Apache Tomcat servers using Shodan integration. Features HTTP/2 priority vulnerability detection Shodan target discovery CSV/JSON reporting Installation python -m venv venv source venv/bin/activate pip install -r requirements.txt...

CLEANSTART-2026-HL28236 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-TJ37962 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-VF27664 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

CVE-2026-54428 affects multiple packages. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5. See references for individual vulnerability details...

CLEANSTART-2026-VU17083 mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource con...

Security vulnerability affects the wso2is package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS...