nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:62219 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

nice-cve-poc

素晴らしいCVE PoCs 興味深いCVE PoCsのコレクション CVE-2023-44487 - HTTP/2 Rapid Reset Attack...

cve-2023-44487-demo

⚡ Démo CVE-2023-44487 – Attaque HTTP/2 Rapid Reset Ce projet démontre la vulnérabilité HTTP/2 « Rapid Reset » CVE-2023-44487 qui permet aux attaquants de submerger les serveurs à l'aide de trames RSTSTREAM, provoquant un déni de service DoS. Il comprend : ✅ Test d'exploit utilisant un outil basé...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 설명 이 저장소는 CVE-2023-44487로 식별된 HTTP/2 Rapid Reset 취약점에 대한 개념 증명PoC 코드를 포함하고 있습니다. 취약점 개요 CVE ID : CVE-2023-44487 영향 : 서비스 거부DoS 영향을 받는 프로토콜 : HTTP/2 영향을 받는 구성 요소 : 웹 서버, 리버스 프록시, 로드 밸런서 공개 날짜 : 2023-10-10 시작하기 사전 요구 사항 Python 3.x hyper 사전 요구 사항 설치: root@kitploit:...

Linux Distros Unpatched Vulnerability : CVE-2026-84304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvM...

CVE-2023-44487

Attaque par Réinitialisation Rapide HTTP2 : CVE-2023-44487 Exploit rapide pour tester l'attaque par réinitialisation rapide CVE-2023-44487. Remarque : À des fins éducatives uniquement. Exploit : Exploit rapide pour tester l'attaque par réinitialisation rapide CVE-2023-44487. Remarque : À des fins...

rapidresetclient

Client de réinitialisation rapide Rapid Reset Client est un outil pour tester les mesures de protection et l'exposition à CVE-2023-44487 vecteur d'attaque DDoS Rapid Reset. Il implémente un client HTTP/2 minimaliste qui ouvre un seul socket TCP, négocie TLS, ignore le certificat, et échange des...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT : mélange de tunnel Code du programme simulation en C root@kitploit: // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the...

tomcat-embed-core-9.0.31-CVE-2020-11996

Veuillez voir le PoC dans le test unitaire testImplicitCloseLargeId de TestHttp2Section51.java : https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny e.g., 1-byte HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment...

GHSA-VP52-PCJ8-J9QC gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny e.g., 1-byte HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...