EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-3994)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

Fedora 44 : curl (2026-8efcd7a2a0)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8efcd7a2a0 advisory. - fix secure cookie attribute bypass with tab CVE-2026-80255 - fix OpenSSL provider use-after-free CVE-2026-80229 ---- - Fix HTTP/2 server push UAF...

SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4558-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4558-1 advisory. - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547:...

CVE-2026-78659: Asymmetric Resource Consumption (Amplification)

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-78663: Multiple Operations on Resource in Single-Operation Context

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-97032: Concurrent Execution using Shared Resource with Improper Synchronization

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

CVE-2026-78660: Inconsistent Interpretation of HTTP Requests

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-94439: Inconsistent Interpretation of HTTP Requests

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

Debian dla-4827 : idle-python3.11 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4827 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4827-1 [email protected]...

EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-3928)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791458607)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791458607 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...

CVE-2026-94439: Inconsistent Interpretation of HTTP Requests

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

openSUSE 16 Security Update : prometheus-blackbox_exporter (openSUSE-SU-2026:22026-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22026-1 advisory. Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumpi...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-3938)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.x000D x000D When the server returns ...

Ubuntu 22.04 LTS : Go Networking vulnerabilities (USN-8900-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8900-1 advisory. It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791459292)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791459292 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...

PT-2026-108314

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server. This occurs when the peer opens a large number of streams and subsequently...

CVE-2026-78669: Asymmetric Resource Consumption (Amplification)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-78669: Asymmetric Resource Consumption (Amplification)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

PT-2026-108315

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An HTTP server handler improperly continues to read and serve requests from a connection after sending a 2xx response to an HTTP/1 CONNECT request without...