Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things IoT botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service DDoS attacks. The new version, tracked as Kimwolf v7, wa...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

[SECURITY] Fedora 43 Update: nghttp2-1.66.0-3.fc43

This package contains the HTTP/2 client, server and proxy programs...

MiracleLinux 9 : nginx:1.24 (AXSA:2026-1509:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1509:01 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Tenable has extracted t...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18618 Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18618 Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18618

The CVE affects ml-metadata where the statically-linked gRPC stack is outdated, exposing HTTP/2 DoS vulnerabilities. An in-cluster attacker with network access to the MLMD pod could send specially crafted HTTP/2 requests to crash the MLMD pod, disrupting all pipeline runs in the affected namespac...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

EUVD-2026-55825

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

GHSA-R28C-9Q8G-F849

creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-17 10:21:36+00:00| seen|...

CVE-2018-11798

creationtimestamp| type| source ---|---|--- 2026-08-10 13:20:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msq6vheark2o 2026-08-13 08:46:14+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0991...

OPENSUSE-SU-2026:21546-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

OPENSUSE-SU-2026:21545-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23131-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23155-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23154-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Photon OS 5.0: Go PHSA-2026-5.0-91-0869

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0869. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nghttp2 PHSA-2026-5.0-92-0802

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0802. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...