26 matches found
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parsing process. An attacker can bypass front-end controls, capture another user's headers, or poison a cache by sending requests with differing duplicate Content-Length headers, especially when th...
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parsing process. An attacker can bypass front-end controls, capture another user's headers, or poison a cache by sending requests with differing duplicate Content-Length headers, especially when th...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the HTTP/2 flow-control process. An attacker can exhaust system memory by sending data faster than it is consumed by the application, causing unbounded buffering and potential service disruption. Details Denial ...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the HTTP/2 flow-control process. An attacker can exhaust system memory by sending data faster than it is consumed by the application, causing unbounded buffering and potential service disruption. Details Denial ...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the H2Connection process. An attacker can exhaust heap memory and cause service disruption by sending HTTP/2 HEADERS or PUSHPROMISE frames without ENDHEADERS, followed by unbounded...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...