PT-2026-89713

These are all security issues fixed in the perl-Protocol-HTTP2-1.140.0-1.1 package on the GA media of openSUSE Tumbleweed...

biz.netcentric.cq.tools.accesscontroltool:sling-maximum-version-environment (>=4.2.0, <=4.2.4), com.atlan:package-toolkit-testing (>=5.3.1, <=7.5.0) +1033 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.0.0.alpha0, <=12.0.36)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.0.0.alpha0, =4.2.0, =5.3.1, =2.6.0-rc1, =2.0.0, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.230 and more Source cves: CVE-2026-12611 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYHTTP2-19653589...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), com.blazemeter.jmeter:jmeter-bzm-http2 (>=3.0.0, <=3.0.1) +695 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.1.0, <=12.1.9)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.1.0, =0.1.7, =3.0.0, =8.0.0, =3.0.0, =2.4.2, =5.0.0, =3.0.0-beta, =4.2.4, =4.2.4, =2.10.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0 and more Source cves: CVE-2026-12611 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYHTTP2-19653589...

EUVD-2026-72733

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

biz.netcentric.cq.tools.accesscontroltool:sling-maximum-version-environment (>=4.2.0, <=4.2.4), com.atlan:package-toolkit-testing (>=5.3.1, <=7.5.0) +1039 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.0.0.alpha0, <=12.0.37)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.0.0.alpha0, =4.2.0, =5.3.1, =2.6.0-rc1, =2.0.0, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.230 and more Source cves: CVE-2026-12611 Source advisory: MEND:CVE-2026-12611...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), com.blazemeter.jmeter:jmeter-bzm-http2 (>=3.0.0, <=3.0.1) +756 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.1.0.alpha0, <=12.1.10)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.1.0.alpha0, =0.1.7, =3.0.0, =8.0.0, =3.0.0, =2.4.2, =1.1.20, =5.0.0, =3.0.0-beta, =4.2.4, =4.2.4, =2.10.0, =0.11.0, =0.2.0, =0.6.0 and more Source cves: CVE-2026-12611 Source advisory: MEND:CVE-2026-12611...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

DEBIAN-CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

UBUNTU-CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

EUVD-2026-72527

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

The Protocol::HTTP2 Perl module (versions before 1.14 ) is vulnerable to memory exhaustion leading to a denial of service . The root cause is that the stream_state function fails to remove closed streams from the connection stream table, allowing a peer to indefinitely accumulate residual entries...

CVE-2026-16028: Missing Release of Memory after Effective Lifetime

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

PT-2026-86914

Name of the Vulnerable Software and Affected Versions Protocol::HTTP2 versions prior to 1.14 Description An issue exists where memory exhaustion can occur because closed streams are not removed from the connection stream table by the stream state function. When a stream reaches the CLOSED state,...

Linux Distros Unpatched Vulnerability : CVE-2026-16028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a...