CLEANSTART-2026-QQ59156 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service...

CLEANSTART-2026-BU08584 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service...

CLEANSTART-2026-BX90561 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...

EUVD-2026-105987

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

EUVD-2026-105980

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful...

EUVD-2026-105978

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

AlmaLinux 9 : golang (ALSA-2026:86196)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86196 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-78663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread...

Linux Distros Unpatched Vulnerability : CVE-2026-78660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. Howeve...

Linux Distros Unpatched Vulnerability : CVE-2026-78659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler...

Atlassian Confluence 7.11.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104518)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104518 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset Thi...

PT-2026-120542

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

PT-2026-120535

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max body size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...

PT-2026-120785

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebsockets (UTSA-2026-142308)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142308 advisory. libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra...

Vulnerability related to improper handling of Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain a logic error vulnerability stemming from an interpretation conflict in the HTTP protocol implementation. The method dispatch function FindMethodPropertyByURI utilizes a string splitter that skips empty fields to segment request paths; this causes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142310 advisory. A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination...

Linux Distros Unpatched Vulnerability : CVE-2026-101356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response...

PT-2026-120528

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

PT-2026-120531

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...