Important: mount-s3

Issue Overview: Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted...

PT-2026-115881

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS INITIAL WINDOW SIZE values...

PT-2026-115889

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

Golang 1.26.x < 1.26.9 / 1.27.x < 1.27.2 Multiple Vulnerabilities

The version of Golang running on the remote host is 1.26.x prior to 1.26.9, or 1.27.x prior to 1.27.2. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory, including: - On Windows, when the target of...

PT-2026-115878

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-3233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3233 advisory. Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client...

PT-2026-115879

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

PT-2026-115877

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) affected by an Uncontrolled Resource Consumption Vulnerability in Apache Tomcat (CVE-2026-68763)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD uses Apache Tomcat for its web interface and services. CVE-2026-68763. Vulnerability Details CVEID:CVE-2026-68763 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog trackin...

DEBIAN-CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.59 packages and security update

Red Hat OpenShift Container Platform release 4.17.59 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Astra Linux – vulnerability in golang-google-grpc

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 contain an authorization bypass vulnerability caused by improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the...

Astra Linux – Vulnerability in curl

During an upload process, curl improperly handles HTTP/2 RSTSTREAM requests received from the server. This occurs when the reason for the refusal is HTTP11REQUIRED or REFUSEDSTREAM. As a result, a use-after-free condition arises for the struct Curleasy object...

Astra Linux - Vulnerability in golang-golang-x-net, golang-1.19

An attacker can cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request’s headers exceed MaxHeaderBytes, no...

Astra Linux – Vulnerability in golang-golang-x-net

In net/http in Go, before versions 1.18.6 and 1.19.x, and before version 1.19.1, attackers can cause a denial of service because an HTTP/2 connection may become unresponsive during closure, if the shutdown process is interrupted by a fatal error...

io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...

io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...