ALSA-2026:88189 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

EUVD-2026-105980

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful...

EUVD-2026-105978

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-101572

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful...

CVE-2026-101570

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

io.helidon.webclient:helidon-webclient-grpc (>=27.0.0-m1, <=27.0.0), io.helidon.webclient:helidon-webclient-grpc-tracing (>=27.0.0-m1, <=27.0.0) +3 more potentially affected by CVE-2026-101572 via io.helidon.webclient:helidon-webclient-http2 (>=27.0.0-m1, <=27.0.0)

io.helidon.webclient:helidon-webclient-http2 MAVEN version =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0-m1, =27.0.0 Source cves: CVE-2026-101572 Source advisory: MEND:CVE-2026-101572...

CVE-2026-101572

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful...

com.hedera.pbj:pbj-grpc-client-helidon (>=0.11.8, <=0.16.3), com.oracle.coherence.ce:coherence-grpc-client-helidon (>=24.09, <=25.03.2) +36 more potentially affected by CVE-2026-101572 via io.helidon.webclient:helidon-webclient-http2 (>=4.0.0-m2, <=4.5.5)

io.helidon.webclient:helidon-webclient-http2 MAVEN version =4.0.0-m2, =0.11.8, =24.09, =0.11, =0.11, =0.11, =0.11, =0.11, =4.2.0, =4.0.0-rc1, =4.1.1, =4.1.0, =4.2.4, =4.1.0, =4.5.5 and more Source cves: CVE-2026-101572 Source advisory: MEND:CVE-2026-101572...

CVE-2026-101572

A vulnerability exists in the helidon-webclient-http2 component of the Helidon product within Oracle Fusion Middleware, affecting versions 4.0.0-4.5.5 and 27.0.0 . An unauthenticated attacker with network access via HTTP/2 can exploit this flaw to cause a hang or frequently repeatable crash , lea...

CVE-2026-101570

A vulnerability exists in the helidon-webserver-http2 component of the Helidon product within Oracle Fusion Middleware . Affected versions range from 4.0.0 to 4.5.5 . An unauthenticated attacker with network access via HTTP/2 can exploit this difficulty-to-exploit vulnerability to cause a partial...

PT-2026-119250

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

PT-2026-119252

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful...

Oracle Helidon security vulnerabilities

Security vulnerabilities exist in Oracle Helidon versions 4.0.0 through 4.5.5 and 27.0.0. These stem from issues in the helidon-webclient-http2 component and may allow unauthenticated attackers to access the service via HTTP/2 networks, potentially leading to service hangs or frequent crashes...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 4.0.0 to 4.5.5 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-webserver-http2 component. The vulnerabilities are difficult to exploit, and unauthenticated attackers can cause denial-of-service attacks by accessing through HTTP/2...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Astra Linux – vulnerability in Tomcat9

A vulnerability related to uncontrolled resource consumption in Apache Tomcat occurs when an HTTP/2 client fails to acknowledge the initial settings frame designed to limit the maximum number of concurrent streams. This issue affects Apache Tomcat versions 11.0.0-M1 through 11.0.8, 10.1.0-M1...

Astra Linux - vulnerability in qtbase-opensource-src

An issue was found in HTTP/2 in Qt prior to version 5.15.18, 6.x prior to 6.2.13, 6.3.x through 6.5.x prior to 6.5.7, and 6.6.x through 6.7.x prior to 6.7.3. Code responsible for making security-related decisions regarding an established connection may execute prematurely, as the encrypted signal...