http2-rst-stream-attacker

CVE-2023-44487 and http2-rst-stream-attacker CVE-2023-44487 CVE-2023-44487 is an exploit against the HTTP2 protocol itself. In HTTP2, requests for data are initiated by sending a HEADERS frame. After receiving this frame, a server will start processing your request, subsequently sending DATA fram...

CVE-2023-44487-dos

CVE-2023-44487 HTTP/2 Rapid Reset There are some examples in this repo which are not tested completely to analyse the impact, but I just wanted to perform the concept of this attack starting many streams and immediately sending RSTSTREAM frame to avoid reaching MAXCONCURRENTSTREAMS. I use H2Space...

h2spacex

H2SpaceX HTTP/2 low level library based on Scapy which can be used for Single Packet Attack Race Condition on H2 This library was part of an academic research with title of QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities. Dive into Single Packet Attack Article I wrote an article...

Linux Distros Unpatched Vulnerability : CVE-2026-12611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and t...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to a race condition in the server when handling RSTSTREAM and GOAWAY frames. An attacker can cause the server to become unresponsive by sending specially crafted HTTP/2 requests...

CVE-2026-12611

CVE-2026-12611 affects the Eclipse Jetty HTTP/2 server implementation. A client can trigger a race condition in the server's handling of RST_STREAM and GOAWAY frames, which resets HTTP2Flusher.terminated back to null. This allows flusher entries to be enqueued that are never processed, leaving wr...

EUVD-2026-72733

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...