CVE-2026-23918-Passive-Audit

CVE-2026-23918 audit script alternatively you could just curl the headers and take a peek, but here comes the: Non-invasive HTTP metadata auditor for Apache HTTP Server CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 exposure triage. The tool sends ordinary HTTP HEAD/GET...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Apache-CVE-2026-23918-fix

Servidor HTTP Apache: http2: Doble liberación y posible RCE en reinicio temprano CVE-2026-23918. Vulnerabilidad de doble liberación y posible RCE en el Servidor HTTP Apache con el protocolo HTTP/2. Este problema afecta al Servidor HTTP Apache: 2.4.66. Se recomienda a los usuarios actualizar a la...

CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit

Exploit de DoS HTTP/2 de Restablecimiento Rápido CVE-2023-44487 Edición Profesional v1.0.1 | Autor: Sudeepa Wanigarathna -orange.svg Tabla de contenidos Descripción general Detalles de la vulnerabilidad Características Requisitos Instalación Inicio rápido Guía de uso Opciones de configuración...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-86043 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

CVE-2026-23918

Escáner Apache HTTP/2 CVE-2026-23918 Esta herramienta es proactiva para la auditoría de seguridad. Para tu repositorio de GitHub, querrás una descripción que destaque su seguridad no intrusiva y su utilidad específica para administradores de sistemas. Aquí tienes algunas opciones para la...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-56848

CVE-2026-56848 Descripción de NVD Una falla en el manejo de HTTP/2 en Node.js permite que se llame a nghttp2sessionmemsend de forma reentrante mientras nghttp2sessionmemrecv está en ejecución, lo que resulta en un heap-use-after-free. Esta vulnerabilidad afecta a Node.js 26.x, 24.x y 22.x. Nota:...

CVE-2026-18924

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service. Mitigation Disable HTTP/2 Server Pu...

Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. CVE-2026-33540: information disclosure via improper validation of authentication...

SUSE-SU-2026:4212-1 Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authenticati...

CVE-2026-23918-Elite-Auditor

☣️ CVE-2026-23918-Elite-Auditor ☣️ Herramienta profesional de inteligencia y reconocimiento para la vulnerabilidad de doble liberación double-free en Apache HTTP/2. 📌 Descripción general CVE-2026-23918 CVSS 8.8 es un fallo crítico de corrupción de memoria en Apache HTTP Server 2.4.66. Este auditor...

CVE-2026-92081

A flaw was found in fastify. When a route registers a response trailer and is served over HTTP/2, fastify incorrectly sets the 'Transfer-Encoding: chunked' header. This leads to an unhandled exception in Node.js, causing the server process to crash and resulting in a Denial of Service DoS. A...

CVE-2026-92081

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

EUVD-2026-80315

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-92081

fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Descripción Este repositorio contiene código de prueba de concepto PoC para la vulnerabilidad HTTP/2 Rapid Reset identificada como CVE-2023-44487. Resumen de la vulnerabilidad ID de CVE : CVE-2023-44487 Impacto : Denegación de servicio DoS Protocolos afectados :...

HTTP-2-Rapid-Reset-DDos

Ataque DoS de Restablecimiento Rápido de HTTP/2 Descripción Este proyecto demuestra el ataque de Denegación de Servicio DoS por Restablecimiento Rápido de HTTP/2 utilizando una topología de red personalizada creada con Containernet. El ataque explota vulnerabilidades en el protocolo HTTP/2 para...