SUSE CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuous...

DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 10.2.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose asset...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

OESA-2026-4241 python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from...

OESA-2026-4242 python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from...

OESA-2026-4240 python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from...

OESA-2026-4239 python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from...

BIT-GOLANG-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

BIT-GOLANG-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

BIT-GOLANG-2026-78663 Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

BIT-GOLANG-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

BIT-GOLANG-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 7.11.0, 7.12.0, 7.13.0, 7.14.0, 7.15.0, 7.16.0, 7.17.0, 7.18.0, 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and...

MITM (Man-in-the-Middle) axios Dependency in Jira Service Management Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 10.3.13 and 11.3.0 of Jira Service Management Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N allows an...

MITM (Man-in-the-Middle) axios Dependency in Jira Software Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 10.3.13 and 11.3.4 of Jira Software Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N allows an unauthenticated...

CLEANSTART-2026-QJ90552 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-VR65122 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-OD75030 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-BO67242 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...