CVE-2026-62750

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network...

CVE-2026-62750 Windows HTTP Protocol Stack Tampering Vulnerability

...

CVE-2026-62750

CVE-2026-62750 affects Windows HTTP Protocol Stack (http.sys). A partial string comparison vulnerability in the stack enables an unauthenticated attacker on an adjacent network to perform tampering. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates adjacent access with no privileges...

EUVD-2026-56372

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network...

CVE-2026-62750 Windows HTTP Protocol Stack Tampering Vulnerability

...

Windows HTTP Protocol Stack Tampering Vulnerability

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network...

PT-2026-70510

Name of the Vulnerable Software and Affected Versions Windows HTTP Protocol Stack affected versions not specified Description A partial string comparison issue in the Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network, which can affect the...

CVE-2026-62750: Partial String Comparison

Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network...

org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform allows a perpetrator to gain full control over the application.

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain full control over the application using the HTTP network protocol...

CVE-2026-65325 Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

CVE-2026-58150

Summary: Apache Traffic Server is vulnerable to HTTP/2 downgrade request smuggling because it does not reject Transfer-Encoding in HTTP/2 requests. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. Impact: Verified issue exists; CVSS metrics indicate HIGH severity with network attack v...

PT-2026-65435

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow hpack common:dec big int/3 in src/co...

Уязвимость компонента Core сервера приложений Oracle WebLogic Server, позволяющая нарушителю получить полный контроль над приложением

Уязвимость компонента Core сервера приложений Oracle WebLogic Server связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить полный контроль над приложением с использованием сетевого HTTP-протокола...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)

According to its self-reported version, the Tenable Security Center running on the remote host is between 6.6.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory. - Tenable Security Center is affected by a SQL injection vulnerability...

CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in Undici's HTTP/1.1 client, specifically related to response queue poisoning on reused keep-alive sockets. This allows the attacker to inject an unsolicited HTTP/1.1 response onto an idle socket...

CVE-2026-54340

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

CVE-2026-35146 HCL DFXServer is affected by an Unencrypted Communication vulnerability.

HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user...

CVE-2026-48068

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in...