CVE-2026-116078: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit…

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...

Linux Distros Unpatched Vulnerability : CVE-2026-111103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection...

Rocky Linux 9.6 [TuxCare] Security Update: grafana-pcp Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793112759)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793112759 advisory. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and the...

Linux Distros Unpatched Vulnerability : CVE-2026-115269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker...

AlmaLinux 9.6 [TuxCare] Security Update: grafana-pcp Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793112759)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793112759 advisory. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then...

CVE-2026-118659: Server-Side Request Forgery (SSRF)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in...

Linux Distros Unpatched Vulnerability : CVE-2026-109584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote...

Linux Distros Unpatched Vulnerability : CVE-2026-108529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU...

Linux Distros Unpatched Vulnerability : CVE-2026-108525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to...

MiracleLinux 9 : golang-1.26.10-1.el9_8 (AXSA:2026-2175:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2175:11 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via...

AlmaLinux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793216388)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793216388 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an...

AlmaLinux 9.6 [TuxCare] Security Update: delve Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793215478)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793215478 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be...

Linux Distros Unpatched Vulnerability : CVE-2026-113436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU...

PT-2026-128251

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do read data/5 in lib/bandit/http2/stream.ex keeps every DA...

Mat Trudel Bandit resource management error vulnerability

Versions 0.3.1 through 1.14.1 of Mat Trudel Bandit contain a resource management error vulnerability. This flaw arises because the HTTP/2 request body reader fails to impose restrictions on resource allocation. The :length option in readbody/2 counts bytes rather than frames. Unauthenticated remo...

David Ortner Happy DOM server-side request forgery vulnerability

David Ortner: Versions prior to Happy DOM 21.0.2 contain a server-side request forgery vulnerability. This occurs because ServerRendererServer accepts unauthenticated HTTP/2 requests and invokes fetch without first verifying whether the resolved origin is trusted. As a result, attackers can explo...

Rocky Linux 9.6 [TuxCare] Security Update: delve Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793215478)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793215478 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not ...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793216388)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793216388 advisory. - When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume a...

Important: Red Hat Security Advisory: yggdrasil security update

An update for yggdrasil is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...