Improper HAProxy exception handling vulnerability

HAProxy has a vulnerability related to improper exception handling. This vulnerability stems from the lack of validation for short reads in h2chandleping within src/muxh2.c. As a result, truncated HTTP/2 PING frames cannot be processed, and no data is consumed. Consequently, H2 multiplexing tasks...

Man-In-The-Middle Proxy 12.3.0

mitmproxy is an open source, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSocket traffic. It enables users to inspect, capture, modify, and replay HTTP and HTTPS communications for debugging, traffic analysis, and security testing. The package includes mitmproxy, an interactive...

ALSA-2026:88280 Important: golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial o...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extensio...

PT-2026-120964

Name of the Vulnerable Software and Affected Versions HAProxy versions 3.2 through 3.4.5 Description A remote unauthenticated attacker can cause a denial of service resulting in worker-thread CPU exhaustion by sending a truncated HTTP/2 PING frame. The function h2c handle ping in src/mux h2.c fai...

RHEL 10 : podman (RHSA-2026:88336)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88336 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2026:88280)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:88280 advisory. HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-U...

Linux Distros Unpatched Vulnerability : CVE-2026-110353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker- thread CPU exhaustion via a truncated HTTP/2 PING frame...

PT-2026-120930

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.58 Traefik versions prior to 3.7.14 Description An authentication bypass exists in the SNI Server Name Indication check, which is skipped when the request TLS state is nil. On Go 1.27 builds, unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-111808

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server...

Red Hat: CVE-2026-110353: haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

ALSA-2026:88188 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extensio...

Linux Distros Unpatched Vulnerability : CVE-2026-111805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic...

USN-8890-2 libsoup3 vulnerabilities

USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of...

USN-8890-2: libsoup vulnerabilities

USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of...

CVE-2026-111808

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

CVE-2026-111805

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to versio...

DEBIAN-CVE-2026-111805

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to versio...

DEBIAN-CVE-2026-111808

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers

A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this...