AlmaLinux 9.2 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778129164)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778129164 advisory. - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Rocky Linux 9 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource (crlsa-2023_2177)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20232177 advisory. golang: net/http: handle server errors after sending GOAWAY CVE-2022-27664 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.6 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.6:CLSA-2026:1778148827)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778148827 advisory. - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures...

AlmaLinux 9.6 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.6:CLSA-2026:1778148827)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778148827 advisory. - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nghttp2 (UTSA-2023-002139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002139 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoys HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-85197: heap use-after-free in HTTP/2 client ondataread via GOAWAY during body upload bsc1279238. CVE-2026-85534: heap buffer overflow in SoupSession through ondatasourcereadcallback via SETTINGS frame with crafted INITIALWINDOWSIZE...

SUSE-SU-2026:4274-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-85197: heap use-after-free in HTTP/2 client ondataread via GOAWAY during body upload bsc1279238. - CVE-2026-85534: heap buffer overflow in SoupSession through ondatasourcereadcallback via SETTINGS frame with crafted INITIALWINDOWSIZE...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-85197: heap use-after-free in HTTP/2 client ondataread via GOAWAY during body upload bsc1279238. CVE-2026-85534: heap buffer overflow in SoupSession through ondatasourcereadcallback via SETTINGS frame with crafted INITIALWINDOWSIZE...

SUSE-SU-2026:4273-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-85197: heap use-after-free in HTTP/2 client ondataread via GOAWAY during body upload bsc1279238. - CVE-2026-85534: heap buffer overflow in SoupSession through ondatasourcereadcallback via SETTINGS frame with crafted INITIALWINDOWSIZE...

Important: Red Hat Security Advisory: libsoup3 security update

An update for libsoup3 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

RHEL 10 : libsoup3 (RHSA-2026:68235)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68235 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup,...

SUSE CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to a race condition in the server when handling RSTSTREAM and GOAWAY frames. An attacker can cause the server to become unresponsive by sending specially crafted HTTP/2 requests...

DEBIAN-CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

UBUNTU-CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

EUVD-2026-72733

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...