CVE-2026-64785

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

SUSE CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

PT-2026-63548

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The HTTP/2-to-HTTP/1.x translation layer, specifically within Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter, fails to deduplicate or...

CVE-2026-54340

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 request processing. An attacker can cause a denial of service by sending crafted HTTP/2 traffic that triggers an out-of-memory condition, exhausting available memory and...

AZL-92402 CVE-2026-15713 affecting package libsoup 3.4.4-16

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

CVE-2026-15713

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

AZL-92409 CVE-2026-15712 affecting package libsoup 3.4.4-16

A heap buffer over-read vulnerability was discovered in libsoup's versions: libsoup 3.0 to 3.7.0 HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminate...