CVE-2026-84304

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CVE-2025-31650

Apache Tomcat 10.1.39 - Déni de Service DoS Cet outil effectue une inondation asynchrone de requêtes HTTP/2 à haut volume en utilisant des en-têtes priority malformés pour tester la stabilité des serveurs Apache Tomcat fonctionnant avec les versions 10.1.10 à 10.1.39. ⚠️ Ceci est strictement à des...

cve-2023-44487

CVE-2023-44487 Réinitialisation rapide HTTP/2 Il y a quelques exemples dans ce dépôt qui n'ont pas été complètement testés pour analyser l'impact, mais je voulais simplement mettre en œuvre le concept de cette attaque starting many streams and immediately sending RSTSTREAM frame to avoid reaching...

CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

EUVD-2026-69420

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CVE-2026-84304

CVE-2026-84304 affects gRPC-Go , the Go implementation of gRPC, prior to version 1.83.1 . The root cause resides in internal/transport/transport.go, where each fragmented HTTP/2 DATA frame is stored as a separate recvMsg in the receive buffer. An unauthenticated remote attacker can exploit this b...

CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authorization Bypass.

Summary google.golang.org/grpc is used by IBM Storage Fusion Data Foundation, which could allow Authorization Bypass. CVE-2026-33186. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 security and extras update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

CVE-2026-71554

A flaw was found in h2, a Python library for HTTP/2. This vulnerability allows a remote attacker to perform request smuggling. The library incorrectly processes HTTP/2 requests that contain more than one Host header. When these requests are downgraded to HTTP/1.1 by a consuming application, the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 security and extras update

Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2024-24549

Apache Tomcat의 서비스 거부DoS 취약점에 대한 개념 증명PoC 이 저장소는 Apache Tomcat의 서비스 거부DoS 취약점을 시연하는 개념 증명PoC 스크립트를 포함합니다. 이 취약점은 HTTP/2 요청의 부적절한 입력 검증으로 인해 발생하며, 잠재적인 DoS 상태를 초래합니다. 취약점 설명 CVE-ID : 보류 중 개요 : Apache Tomcat 버전 11.0.0-M1 11.0.0-M16, 10.1.0-M1 10.1.18, 9.0.0-M1 9.0.85 및 8.5.0 8.5.98은 서비스 거부 공격에 취약합니...

HTTP-2-Rapid-Reset-DDos

Attaque DoS par réinitialisation rapide HTTP/2 Description Cette démonstration illustre l'attaque par déni de service DoS par réinitialisation rapide HTTP/2 à l'aide d'une topologie réseau personnalisée créée avec Containernet. L'attaque exploite des vulnérabilités du protocole HTTP/2 pour...

rapid-reset-check

Rapid Reset Check rapid-reset-check est un petit outil CLI en Go permettant d'inventorier rapidement les points de terminaison HTTPS qui exposent HTTP/2 et nécessitent donc une revue de l'atténuation de la CVE-2023-44487. Le scanner n'exploite délibérément pas la vulnérabilité. Il résout chaque...

apache_audit_cve-2026-23918

cve-2026-23918 Outils d'audit défensif pour CVE-2026-23918 double-free RCE HTTP/2 d'Apache HTTPD et quatre CVE associées divulguées dans l'avis de sécurité de la Apache Software Foundation du 4 mai 2026...

CVE-2024-27316

CVE-2024-27316 J'ai décidé d'appeler cette vulnérabilité spécifiquement "CVE-2024-27316" puisque je l'ai testée contre cette vulnérabilité. Le défaut sous-jacent affecte d'autres CVE, donc j'ai pensé mentionner celles-ci dans l'espoir que d'autres puissent tester et modifier ce PoC : Ce PoC ne...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.21.31 security update

Red Hat build of MicroShift release 4.21.31 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

PT-2026-84378

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1 Description An unauthenticated remote attacker can cause a remote Denial of Service DoS by initiating a gRPC stream and fragmenting the payload into millions of small HTTP/2 DATA frames. In the...