ROS-20261009-73-0214

The vulnerability of the drivers/net/wan/fslucchdlc.c component in the Linux kernel lies in the fact that the same resource or descriptor is released multiple times. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0157

The vulnerability of the lapbethfreedevice function in the drivers/net/wan/lapbether.c module of the Linux kernel network device driver is related to incorrect type conversion or casting. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-98380: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

Golang net/http DoS

The vulnerability of the net/http component in the Golang programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to...

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

SUSE CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

CVE-2026-78667

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-97032

HTTP/2 servers are susceptible to a race condition (CWE-362) that can lead to a server crash. The vulnerability occurs because the HPACK encoder is modified concurrently from two different goroutines without proper synchronization: one goroutine encodes a HEADERS frame for a response, while anoth...

CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-78667 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-94439

An HTTP server handler is vulnerable to request smuggling because it improperly handles HTTP/1 CONNECT requests. When the handler sends a 2xx response without hijacking the connection, it fails to stop treating the connection as HTTP, even though it has been converted into a tunnel. This discrepa...

CVE-2026-78667

The FileServer(FS) , ServeContent , and ServeFile(FS) components are vulnerable to a CPU exhaustion issue. This occurs when parsing a Range header that contains a large number of small ranges, leading to excessive resource consumption. This vulnerability is associated with CWE-770 (Allocation of ...

CVE-2026-78667 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...