7808 matches found
CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...
EUVD-2026-109818
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...
EEF-CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the...
CVE-2026-108525
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...
CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...
CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...
Important: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
DEBIAN-CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
UBUNTU-CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
CVE-2026-96432 Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
CVE-2026-96432 Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
CVE-2026-96432
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
CVE-2026-96432
A null pointer dereference vulnerability exists in the QNetworkAccessManager class of the Qt Network module . A malicious or compromised HTTP/2 server can exploit this by withholding a SETTINGS ACK and sending an RST_STREAM on a completed stream, which plants a null pointer. Subsequent delivery o...
EUVD-2026-109779
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RSTSTREAM on a completed stream, planting a null pointer, and then send a PUSHPROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...