1329 matches found
CVE-2026-56848
CVE-2026-56848 NVD Description A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x. Note: versions mentioned in the descriptio...
Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components
Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...
EulerOS 2.0 SP13 : nghttp2 (EulerOS-SA-2026-4074)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2026-4258)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2026-4348)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
EulerOS 2.0 SP13 : nghttp2 (EulerOS-SA-2026-4165)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
CLEANSTART-2026-DF56906 HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response
Security vulnerability affects the apache2 package. HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response...
EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-3994)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-3928)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nghttp2: libnghttp2-1.69.0-6.1.hum1 aarch64, s390x, x8664 libnghttp2-devel-1.69.0-6.1.hum1 aarch64, s390x, x8664 mingw32-libnghttp2-1.69.0-6.1.hum1 aarch64, s390x, x8664...
nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination
A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...
Astra Linux – Vulnerability in nghttp2
nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. Prior to version 1.68.1, the nghttp2 library would stop reading incoming data when the user-facing public API nghttp2sessionterminatesession or nghttp2sessionterminatesession2 was called by the application. These APIs...
Astra Linux – Vulnerability in nghttp2
nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. The nghttp2 library prior to version 1.61.0 continued to read an unlimited number of HTTP/2 CONTINUATION frames even after a stream was reset, in order to keep the HPACK context synchronized. This caused excessive CPU...
Astra Linux – Vulnerability in Apache2
HTTP/2 incoming headers that exceed the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client continues to send headers, this can lead to memory exhaustion...
[SECURITY] Fedora 45 Update: nghttp2-1.69.0-6.fc45
This package contains the HTTP/2 client, server and proxy programs...
CLEANSTART-2024-OD86351 When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by ...
Security vulnerability affects the dnsdist package. When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IX...
CLEANSTART-2026-CI31043 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
Security vulnerability affects the nghttp2 package. nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C...
CLEANSTART-2024-ZU11718 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Security vulnerability affects the nghttp2 package. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service...
CLEANSTART-2024-IW99789 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Security vulnerability affects the nghttp2 package. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service...