New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in each server's...

@basemachina/ai-csv-editor (>=0.1.0 <=0.2.1), @ecomiq/storefront (>=0.1.0 <=1.0.1) +14 more potentially affected by CVE-2025-6087 +1 more via @opennextjs/cloudflare (>=1.0.1 <=1.19.7)

@opennextjs/cloudflare NPM version =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.694, =0.0.1, =0.0.6 - next-ai-draw-io =0.4.10 - opennext-oss-provider =0.0.1 and more Source cves: CVE-2025-6087, CVE-2026-3125 Source advisory: OSV:GHSA-RVPW-P7VW-WJ3M...

Cloudflare Public Bug Bounty: Any WARP User Can Access Organization-Specific Application

Vulnerability description not provided...

Buffer Overflow Vulnerability in CloudFlare Server

CloudFlare is a U.S. content delivery network CDN and network security provider, mainly providing technical support to customer websites related to website security management, performance optimization and other related technical support. CloudFlare serves more than 5.5 million websites worldwide...