ALPINE-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

DEBIAN-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

UBUNTU-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

CVE-2025-8671 CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

CVE-2025-8671

The MadeYouReset vulnerability (CVE-2025-8671 ) is a Denial-of-Service (DoS) flaw in several HTTP/2 implementations, including Varnish , Fastly , Jetty , SUSE , Wind River , and lighttpd . The root cause is a mismatch between HTTP/2 specifications and internal architectures where a client trigger...

CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

CVE-2025-8671 CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

Exploit for Path Traversal in Rarlab Winrar

CVE-2025-8088 WinRAR Proof of Concept PoC-Exploit !PoCht...

PT-2025-32999

Name of the Vulnerable Software and Affected Versions: Netty versions prior to 4.1.124.Final Netty versions prior to 4.2.4.Final Description: Netty is an asynchronous, event-driven network application framework vulnerable to a MadeYouReset DDoS attack. This issue is a logical vulnerability in the...

www/varnish7 -- Denial of Service in HTTP/2

Varnish Development Team reports: A denial of service attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker can create a large number of streams and immediately reset them without ever reaching the maximum number of concurrent streams allowed for th...

PT-2025-33005

Name of the Vulnerable Software and Affected Versions: Affected versions not specified Description: An implementation flaw in HTTP/2 can lead to a denial-of-service DoS condition. This occurs through the use of malformed HTTP/2 control frames, which disrupt the maximum concurrent streams limit,...

BIT-LIBPHP-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when receiving headers from HTTP server, the headers missing a colon : are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers...

BIT-LIBPHP-2024-11234 Configuring a proxy in a stream context might allow for CRLF injection in URIs

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests...

Linux Distros Unpatched Vulnerability : CVE-2019-11713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This...

Linux Distros Unpatched Vulnerability : CVE-2023-6207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox 120, Firefox ESR 115.5.0, and Thunderbird 115.5...

Linux Distros Unpatched Vulnerability : CVE-2023-25752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code ...

Security update for libarchive

This update for libarchive fixes the following issues: CVE-2025-5914: Fixed double free due to an integer overflow in the archivereadformatrarseekdata function bsc1244272 CVE-2025-5915: Fixed heap buffer over read in copyfromlzsswindow at archivereadsupportformatrar.c bsc1244273 CVE-2025-5916:...

Freedesktop Poppler 安全漏洞

Freedesktop Poppler is a C++ class library from the Freedesktop community for generating PDFs, which is inherited from Xpdf PDF reader. A security vulnerability exists in Freedesktop Poppler version v25.04.0, which stems from the failure to clear heap memory containing PDF stream objects upon...

Important: Red Hat Security Advisory: Streams for Apache Kafka 3.0.0 release and security update

Streams for Apache Kafka 3.0.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...