CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT 터널 혼동 프로그램 코드 C 시뮬레이션 // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if streamid == 0 printf"CONNECT to...

tomcat: HTTP/2 request header mix-up

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this...