PT-2026-146063

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 2.0.0 through 2.1.5 Description The WebSocket upgrade handler fails to attach an error listener to the socket before waiting for the Hono application to complete asynchronous middleware or handler tasks. An...

CVE-2026-119237

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

CVE-2026-119236

An mvfst QUIC server retained CRYPTO frame data received at an encryption level Initial or Handshake that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

CVE-2026-119236

An mvfst QUIC server retained CRYPTO frame data received at an encryption level Initial or Handshake that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could...

CVE-2026-119237

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

EUVD-2026-123607

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

CVE-2026-119237

The proxygen HTTP/3 session is vulnerable to a Denial of Service (DoS) attack in versions prior to v2026.11.09.00 . When a HEADERS block references QPACK dynamic table entries that have not been received, header decoding pauses while the session continues to read from the QUIC transport. This all...

CVE-2026-119237

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

CVE-2026-119236

The mvfst QUIC server is vulnerable to a denial of service (DoS) condition in versions prior to v2026.11.09.00 . The root cause is that the server retains CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake has already passed. Because the transport trea...

EUVD-2026-123606

An mvfst QUIC server retained CRYPTO frame data received at an encryption level Initial or Handshake that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could...

CVE-2026-119233

The proxygen HTTP/3 codec is vulnerable to a denial of service due to how it handles incomplete non-DATA frames (such as control-stream frames, unknown types, or HEADERS frames). The root cause is that the codec buffers these frames until their entire declared length is received without imposing ...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

EUVD-2026-123603

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

CVE-2026-119237: Facebook proxygen: In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been…

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

PT-2026-145272

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

PT-2026-145268

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...