net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

PT-2026-132483

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793290409)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793290409 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793284553)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793284553 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an...

tomcat security update

1:9.0.121-1 - Resolves: RHEL-255793 tomcat: Security constraint bypass due to improper access control CVE-2026-65182 - Resolves: Local information disclosure via Unix domain socket TOCTOU race condition CVE-2026-65183 - Resolves: RHEL-271822 tomcat: Improper Input Validation allows HTTP/2...

Linux Distros Unpatched Vulnerability : CVE-2026-116078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793290409)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793290409 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not ...

RHEL 10 : yggdrasil (RHSA-2026:91138)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91138 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate chil...

CVE-2026-118659

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659

The @happy-dom/server-renderer package (prior to version 21.0.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) and can be used as an Open Proxy . The root cause is located in the #onIncomingRequest function within packages/@happy-dom/server-renderer/src/ServerRendererServer.ts, where the...

EUVD-2026-112466

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-118659 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

CVE-2026-111808

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending a malformed padded HTTP/2 DATA frame. This issue causes the exhaustion of the backend HTTP/1.1 origin server's worker pool, resulting in a Denial of Service DoS. Mitigation Upgrade Apache Traffi...

CVE-2026-111805

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending an HTTP/2 request containing a truncated Content-Length header. This causes Apache Traffic Server to exhaust the worker connection pool of upstream HTTP/1.1 origin servers, resulting in a Denial...

OPENSUSE-SU-2026:22180-1 Security update for kubevirt1.9

This update for kubevirt1.9 fixes the following issues: - CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host bsc1272840. - CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers bsc1286984. - CVE-2026-78660:...

net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

CVE-2026-116078

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...

UBUNTU-CVE-2026-116078

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...