Rocky Linux 9 [CIQ] Security Update: libnghttp2 / libnghttp2-debuginfo / libnghttp2-devel / nghttp2 / etc (crlsa-2023_5838)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235838 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2023_5924)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235924 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging (crlsa-2023_5850)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235850 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...

RHEL 9 : skopeo (RHSA-2026:74581)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:74581 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-docs / etc (crlsa-2023_5765)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235765 advisory. nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 A Rocky Enterprise Software Foundation Securit...

EUVD-2026-80315

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses...

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

CLEANSTART-2026-TQ18292 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the crane package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy. The HTTP/2 path builds a session with...

EUVD-2026-88367

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls...

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...

NPM: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

NPM: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.49 security and extras update

Red Hat OpenShift Container Platform release 4.19.49 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

CVE-2025-31650

Apache Tomcat 10.1.39 - Denegación de Servicio DoS Esta herramienta realiza una inundación de solicitudes HTTP/2 asíncronas de alto volumen utilizando cabeceras priority malformadas para probar la estabilidad de servidores Apache Tomcat que ejecutan las versiones 10.1.10 a 10.1.39. ⚠️ Esto es...

cve-2023-44487

CVE-2023-44487 HTTP/2 Restablecimiento Rápido Hay algunos ejemplos en este repositorio que no se han probado completamente para analizar el impacto, pero solo quería realizar el concepto de este ataque starting many streams and immediately sending RSTSTREAM frame to avoid reaching...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2024:1715280815)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1715280815 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

Linux Distros Unpatched Vulnerability : CVE-2026-101898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy setting...