Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

MiracleLinux 9 : golang-1.26.3-1.el9_8 (AXSA:2026-1288:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1288:06 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity...

SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3022-1 advisory. Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when ...

mod_http2 security, bug fix, and enhancement update

2.0.29-4.2 - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 2.0.29-4.1 - Resolves: RHEL-182410 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 2.0.29-4 - Resolves: RHEL-166269 - httpd: Apache HTTP Server: HTTP/2 DoS by...

RockyLinux 8 : nodejs:24 (RLSA-2026:39868)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:39868 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-59762

CVE-2026-59762 affects BIG-IP’s TMM when an HTTP/2 profile is configured on a virtual server. Affected: HTTP/2 profile handling can cause undisclosed requests to increase memory resource utilization, leading to degraded system performance and potential DoS. This is a remote, unauthenticated data-...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding bsc1208300. CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header...

ROOT-APP-MAVEN-CVE-2026-50560 CVE-2026-50560 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-50560 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-47244 CVE-2026-47244 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-47244 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-33871 CVE-2026-33871 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-33871 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-48043 CVE-2026-48043 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-48043 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

SUSE-SU-2026:3022-1 Security update for sccache

This update for sccache fixes the following issues: Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes HTTP2 RSTSTREAM frames bsc1210346. - CVE-2024-32650: rust-rustls: infinite loop in...

The vulnerability of the mod_http2 module in the Apache HTTP Server allows a attacker to cause a service failure.

The vulnerability of the modhttp2 module in the Apache HTTP Server relates to the possibility of using memory after it is released. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-15712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer over-read vulnerability was discovered in libsoup's versions: libsoup 3.0 to 3.7.0 HTTP/2 connection tracking framework. When the library processe...

CVE-2026-48068

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote...

ROOT-APP-MAVEN-CVE-2025-55163 CVE-2025-55163 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2025-55163 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

Security update for gosec (important)

openSUSE Security Update: Security update for gosec Announcement ID: openSUSE-SU-2026:0244-1 Rating: important References: 1265919 1266209 1266793 1267195 Affected Products: openSUSE Backports SLE-15-SP7 An update that contains security fixes can now be installed. Description: This update for gos...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8525-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8525-1 advisory. Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP...