PT-2026-128251

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do read data/5 in lib/bandit/http2/stream.ex keeps every DA...

UBUNTU-CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

EEF-CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the...

CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525

The mtrudel bandit library (versions 0.3.1 before 1.14.0 ) contains an Allocation of Resources Without Limits or Throttling vulnerability in its HTTP/2 implementation. The root cause is that Bandit.HTTP2.Connection.handle_frame/3 forwards DATA frames to the stream process without checking the rec...

EUVD-2026-109818

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

PT-2026-123293

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-80463

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463

Apache bRPC (version

EUVD-2026-107188

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

PT-2026-120546

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

Apache Traffic Server digital error vulnerability

A numerical error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability stems from improper handling of specially crafted HTTP/2 DATA frames, potentially leading to exhaustion of the worker pool on...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: Only QoS data frames are tracked for admission control. For admission control, it clearly only applies to QoS data frames. Otherwise, we wouldn’t even be able to access the QoS field in the header. Syzbot reported an...

CVE-2026-84304

A flaw was found in gRPC-Go. This vulnerability allows an unauthenticated remote attacker to exhaust process memory by sending millions of fragmented HTTP/2 DATA frames. Each fragmented frame is stored as a separate message, consuming disproportionate heap memory. This can lead to a runtime panic...