CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO server implementation (src/co_sdo_server.c ). The vulnerability occurs because the system fails to properly validate write permissions when processing download-segment frames . An unauthenticated attacker on the CAN bus can i...

CVE-2026-82358 RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

SUSE CVE-2026-98061

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to inefficient handling of large or invalid ranges in disposition frames, which allows an authenticated attacker to cause excessive CPU consumption and trigger a denial-of-service condition...

CLEANSTART-2026-HC06922 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the exoscale package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2026-CN84558 attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

Security vulnerability affects the cri-tools package. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames...

CLEANSTART-2026-EH49722 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CVE-2026-82358: Incorrect Authorization

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

PT-2026-103996

Name of the Vulnerable Software and Affected Versions RT-Labs AB C-Open CANopen versions prior to 1.1.1 Description A write protection bypass exists in the SDO Service Data Object server implementation within src/co sdo server.c. The issue occurs because the system fails to properly validate writ...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2024_1962)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241962 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2026_7668)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20267668 advisory. nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-27135 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2024_2699)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242699 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288,VU421644.3 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2024_4252)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244252 advisory. nghttp2: CONTINUATION frames DoS CVE-2024-28182 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has...

Rocky Linux 10.1 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2026_7666)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20267666 advisory. nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-27135 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource (crlsa-2024_1939)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241939 advisory. Mozilla: Denial of Service using HTTP/2 CONTINUATION frames CVE-2024-3302 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc Multiple Vulnerabilities (crlsa-2019_4273)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20194273 advisory. HTTP/2: flood using PING frames results in unbounded memory growth CVE-2019-9512 HTTP/2: flood using HEADERS frames results in unbounded memory growth...

Rocky Linux 8 [CIQ] Security Update: nginx / nginx-all-modules / nginx-debuginfo / nginx-debugsource / etc Multiple Vulnerabilities (crlsa-2019_2799)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20192799 advisory. HTTP/2: large amount of data request leads to denial of service CVE-2019-9511 HTTP/2: flood using PRIORITY frames resulting in excessive resource consumpti...