MGASA-2026-0349 Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

CVE-2026-54556

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

GHSA-VMM3-XGCX-67HM http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-54556

http4s (Scala HTTP library) versions prior to 0.23.35 and 1.0.0-M47 are vulnerable to an out-of-memory denial of service when using the Ember backend with HTTP/2 enabled. The root cause is a HPACK bomb : the Hpack wrapper concatenates HEADERS and CONTINUATION frame fragments into a single decoded...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

PT-2026-82110

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47 Description An unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend when HTTP/2 is enabled. The issue resides in the Hpack wrapper...

Astra Linux – Vulnerability in qtbase-opensource-src

A issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. There is an incorrect HPack integer overflow check in network/access/http2/hpacktable.cpp...

MiracleLinux 9 : haproxy-2.8.14-3.el9_8.2 (AXSA:2026-1627:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1627:03 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow i...

PT-2026-81074

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

MiracleLinux 8 : haproxy-1.8.27-5.el8_10.2 (AXSA:2026-1575:02)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1575:02 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

haproxy security update

An update is available for haproxy. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The haproxy packages provide a reliable, high-performance network load...

RLSA-2026:55679 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...