140533 matches found
CLEANSTART-2026-MO36230 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
Security vulnerability affects the argo-workflows package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...
CLEANSTART-2026-YS82863 mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource con...
Security vulnerability affects the sonarqube package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS...
CLEANSTART-2026-IW41585 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)
Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...
CLEANSTART-2026-HU83595 client may issue specially crafted HTTP/1
Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...
CLEANSTART-2026-CI10932 In Eclipse Jetty, a first HTTP/1
Security vulnerability affects the kafka package. In Eclipse Jetty, a first HTTP/1...
CLEANSTART-2026-PQ26679 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...
CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled
Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...
CLEANSTART-2026-DB50494 vulnerability occurs when a client sends HTTP/1
Security vulnerability affects the elasticsearch package. The vulnerability occurs when a client sends HTTP/1...
CLEANSTART-2026-CQ96086 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials
Security vulnerability affects the elasticsearch package. In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials...
CLEANSTART-2026-WU74095 hpack is an HTTP/2 Header Encoding for Python
Security vulnerability affects the airflow-3 package. hpack is an HTTP/2 Header Encoding for Python...
PT-2026-108570
Security vulnerability affects the airflow-3 package. hpack is an HTTP/2 Header Encoding for Python...
PT-2026-108588
Security vulnerability affects the sonarqube package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS...
PT-2026-102730
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a...
PT-2026-102723
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END STREAM. Envoy completes and deferred-deletes the ActiveRequest...
PT-2026-102894
Name of the Vulnerable Software and Affected Versions mcp-chrome-bridge versions prior to 1.0.32 Description An origin validation error exists in the native-server HTTP API that allows attackers to bypass Cross-Origin Resource Sharing CORS restrictions. CORS is a security mechanism that restricts...
Reyrolle 7SR5 Resource Restriction Malfunction
The vulnerability of the microprogramming software of Reyrolle 7SR5 devices for relay protection and automation systems lies in the fact that resources are allocated without any restrictions or controls during the processing of HTTP requests. Exploiting this vulnerability allows a remote attacker...
PT-2026-109073
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...
PT-2026-109113
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...
CVE-2026-100822: User Interface (UI) Misrepresentation of Critical Information
Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
PT-2026-102911
The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update...