1238 matches found
CVE-2026-56848
CVE-2026-56848 NVD Description A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x. Note: versions mentioned in the descriptio...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nghttp2 (UTSA-2023-002139)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002139 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoys HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in nghttp2 and libarchive
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source packages nghttp2 and libarchive that are affected by three high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Detail...
SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2026:4029-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4029-1 advisory. This update for nghttp2 fixes the following issue: - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request...
EulerOS Virtualization 2.11.0 : nghttp2 (EulerOS-SA-2026-3531)
According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops...
EulerOS Virtualization 2.12.0 : nghttp2 (EulerOS-SA-2026-3655)
According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...
EulerOS Virtualization 2.11.1 : nghttp2 (EulerOS-SA-2026-3444)
According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops...
Astra Linux – Vulnerability in Apache2
HTTP/2 incoming headers that exceed the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client continues to send headers, this can lead to memory exhaustion...
Astra Linux – Vulnerability in nghttp2
nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. The nghttp2 library prior to version 1.61.0 continued to read an unlimited number of HTTP/2 CONTINUATION frames even after a stream was reset, in order to keep the HPACK context synchronized. This caused excessive CPU...
Astra Linux – Vulnerability in nghttp2
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload caused a denial of service. The proof-of-concept attack involved a malicious client repeatedly constructing SETTINGS frames with a size of 14,400 bytes 2400 individual setting entries. This attack caused the CPU usag...
Astra Linux – Vulnerability in nghttp2
nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. Prior to version 1.68.1, the nghttp2 library would stop reading incoming data when the user-facing public API nghttp2sessionterminatesession or nghttp2sessionterminatesession2 was called by the application. These APIs...
Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.19.0 shipped with IBM Cloud Pak for Business Automation iFixes for August 2026
Summary IBM Cloud Pak for Business Automation includes IBM Cloud Pak foundational services. IBM Cloud Pak for Business Automation August 2026 security fixes update this dependency beyond 4.19.0 to address security vulnerabilities. Vulnerability Details CVEID:CVE-2026-27135 DESCRIPTION: nghttp2 is...
Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.19 shipped with IBM Business Automation Workflow containers August 2026
Summary IBM Business Automation Workflow containers include IBM Cloud Pak foundational services. IBM Business Automation Workflow containers August 2026 security fixes update this dependency beyond 4.19 to address security vulnerabilities. Vulnerability Details CVEID:CVE-2026-27135 DESCRIPTION:...
nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...
EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3361)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
Security update for nghttp2
This update for nghttp2 fixes the following issue: CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate...
SUSE-SU-2026:4029-1 Security update for nghttp2
This update for nghttp2 fixes the following issue: - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489...
nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...
nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...