net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers

A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this...

CVE-2026-101579

The helidon-grpc-server component within the Helidon product of Oracle Fusion Middleware is affected by a vulnerability in versions 3.0.0-3.2.21 . An unauthenticated attacker with network access via HTTP/2 can easily exploit this issue to compromise the system. Successful exploitation may lead to...

CVE-2026-101572

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful...

CVE-2026-101572

A vulnerability exists in the helidon-webclient-http2 component of the Helidon product within Oracle Fusion Middleware, affecting versions 4.0.0-4.5.5 and 27.0.0 . An unauthenticated attacker with network access via HTTP/2 can exploit this flaw to cause a hang or frequently repeatable crash , lea...

CVE-2026-101570

A vulnerability exists in the helidon-webserver-http2 component of the Helidon product within Oracle Fusion Middleware . Affected versions range from 4.0.0 to 4.5.5 . An unauthenticated attacker with network access via HTTP/2 can exploit this difficulty-to-exploit vulnerability to cause a partial...

CVE-2026-101570

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers

A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this...

net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service DoS. This issue occurs because the server improperly...

net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion

A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service DoS by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker...

net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-101356

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over,...

Access Control Bypass

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Access Control Bypass in the HTTP/2 asynchronous servlet processing. An attacker can cause requests and responses to be mixed up between users by exploiting...

Access Control Bypass

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Access Control Bypass in the HTTP/2 asynchronous servlet processing. An attacker can cause requests and responses to be mixed up between users by exploiting incorre...

Incomplete Cleanup

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete cleanup in the HTTP/2 trailer header process. An attacker can access sensitive information from previous requests by sending...

Incomplete Cleanup

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete cleanup in the HTTP/2 trailer header process. An attacker can access sensitive information from previous requests by sending...

Apache Traffic Server digital error vulnerability

A numerical error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability stems from improper handling of specially crafted HTTP/2 DATA frames, potentially leading to exhaustion of the worker pool on...

Apache Traffic Server resource management error vulnerability

A resource management error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability arises from exhausting the worker pool of HTTP/1.1 sources by truncating the HTTP/2 Content-Length value, potentiall...

DEBIAN-CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...