7815 matches found
SUSE-SU-2026:24410-1 Security update for docker
This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265782. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allow...
Security update for docker
This update for docker fixes the following issues: Security issues fixed: CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265782. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows fo...
Security Bulletin:Multiple vulnerabilities in netty-codec-http2 may affect IBM Infosphere Change Data Capture (CVE-2026-93492, CVE-2026-93567, CVE-2026-93568, CVE-2026-93569, CVE-2026-93579)
Summary Multiple security vulnerabilities have been identified in netty-codec-http2, Netty/Codec/HTTP2. netty-codec-http2 is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...
RLSA-2026:88188 Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extensio...
CLEANSTART-2026-XI05251 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...
CLEANSTART-2026-PQ26148 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...
CLEANSTART-2026-OB67421 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...
CLEANSTART-2026-WJ81202 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...
CLEANSTART-2026-ZE43765 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-IT87450 flaw was found in Netty's HTTP/2 codec
Security vulnerability affects the elasticsearch package. A flaw was found in Netty's HTTP/2 codec...
Qt resource management error vulnerability
Qt has a resource management error vulnerability stemming from HTTP/2 client support allowing post-free reuse. This may cause client applications running on malicious or compromised HTTP/2 servers to crash, thereby affecting availability...
PT-2026-121831
A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability...
AlmaLinux 10 : podman (ALSA-2026:88336)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88336 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 net/http: net/http/internal/http2: golang.org/x/net/http2:...
SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:4864-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4864-1 advisory. Update to go1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server stream...
Curl 8.12.0 < 8.23.0 HTTP/2 Upload Use-After-Free
The version of curl installed on the remote host is 8.12.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability: - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a stru...
Security update for go1.26 (important)
openSUSE security update: security update for go1.26 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22152-1 Rating: important References: bsc1255111 bsc1284770 bsc1284772 bsc1286261 bsc1286317 Cross-References: CVE-2026-111943 CVE-2026-78663...
SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:4867-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4867-1 advisory. Update to version 1.26.10 bsc1255111, jscSLE-18320: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...
RockyLinux 10 : podman (RLSA-2026:88336)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88336 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 net/http: net/http/internal/http2: golang.org/x/net/http2:...
CVE-2026-78660
A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this...
CVE-2026-78659
A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service DoS by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker...