DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

MITM (Man-in-the-Middle) axios Dependency in Crowd Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in version 7.2.0 of Crowd Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N allows an unauthenticated attacker to potentially...

OPENSUSE-SU-2026:22135-1 Security update for coredns

This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport boo1279216 Done through the gomodules "require" parameter in servi...

Apache Tomcat race condition vulnerability

There are concurrency issues with Apache Tomcat versions 11.0.22 to 11.0.26, 10.1.55 to 10.1.60, and 9.0.118 to 9.0.122. These issues stem from improper object recycling and reuse during HTTP/2 asynchronous Servlet processing, which may lead to confusion between requests and/or responses between...

Oracle Helidon security vulnerabilities

Security vulnerabilities exist in Oracle Helidon versions 4.0.0 through 4.5.5 and 27.0.0. These stem from issues in the helidon-webclient-http2 component and may allow unauthenticated attackers to access the service via HTTP/2 networks, potentially leading to service hangs or frequent crashes...

Cloudflare Pingora resource management error vulnerability

Cloudflare Pingora versions prior to 0.8.1 have a resource management vulnerability. This vulnerability arises from HTTP/2 servers not explicitly limiting the size of the decoded header list and the number of concurrent streams. Remote unauthenticated attackers can exploit this vulnerability by...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 4.0.0 to 4.5.5 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-webserver-http2 component. The vulnerabilities are difficult to exploit, and unauthenticated attackers can cause denial-of-service attacks by accessing through HTTP/2...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 3.0.0 to 3.2.21 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-grpc-server component. Unauthorized attackers may gain access through HTTP/2 networks, allowing them to perform unauthorized updates, insert or delete certain accessible...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

USN-8935-1 golang-1.22 vulnerabilities

It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of service. CVE-2026-33818 It was discovered that Go incorrectly reset the depth counter when...

CVE-2026-85254 Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

SUSE-SU-2026:24279-1 Security update for docker

This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265782. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allow...

Astra Linux – vulnerability in containerd-app

Due to a missing null check, sending HTTP/2 frames with values 0x0a–0x0f can cause a running server to panic...

Astra Linux – vulnerability in Node.js

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerabili...

CLEANSTART-2026-MH20908 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-XJ89582 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-XA13767 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-KS88992 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

SUSE CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuous...