149076 matches found
PT-2026-122771
Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...
PT-2026-115113
Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions prior to 8.2.2 AdonisJS HTTP Server versions prior to 9.1.1 Description A Regular Expression Denial of Service ReDoS exists in the built-in slug route matcher. The regular expression used by router.matchers.slug...
PT-2026-115210
Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The decompress interceptor in this Node.js HTTP client library forwards decompressed response data to the downstream handler via zlib stream event callbacks...
PT-2026-115368
Name of the Vulnerable Software and Affected Versions Sliver versions prior to 1.7.3 Description Sliver is subject to a Denial of Service DoS issue where an unauthenticated user can exhaust the server's RAM, potentially crashing the host device. The issue occurs when an open HTTP listener receive...
PT-2026-122836
Security vulnerability affects the strimzi-kafka-operator package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...
PT-2026-122867
Security vulnerability affects the elasticsearch package. The vulnerability occurs when a client sends HTTP/1...
Linux Distros Unpatched Vulnerability : CVE-2026-110835
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected a...
Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130386)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130386 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcatvia an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach...
CVE-2026-109855
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...
RHCOS 4 : OpenShift Container Platform 4.18.57 (RHSA-2026:79034)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79034 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...
Linux Distros Unpatched Vulnerability : CVE-2026-109855
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is...
Security Updates for Microsoft Visual Studio Products 17.14.42 and 18.10.4 (October 2026)
The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-105016 - Inconsistent interpretation of http requests...
PT-2026-114837
Name of the Vulnerable Software and Affected Versions undici versions 8.11.0 through 8.11.1 Description The experimental WebSocket client in this Node.js HTTP client library mishandles failed WebSocket handshakes over HTTP/2. Because the request is marked as completed, the abort operation is...
PT-2026-114825
In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...
PT-2026-114895
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...
PT-2026-114427
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
PT-2026-115209
Name of the Vulnerable Software and Affected Versions undici versions 4.2.1 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description An issue exists in the HTTP client library where the client process crashes during a TLS 1.2 server renegotiation. This...
PT-2026-122695
Security vulnerability affects the strimzi-kafka-operator package. It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak...
curl/libcurl 8.22.0 HTTP/2 Upload Use-After-Free
curl/libcurl versions 8.12.0 through 8.22.0 contain an HTTP/2 upload use-after-free when processing RSTSTREAM frames. The supplied proof of concept provides local assessment and an opt-in loopback protocol probe. https://packetstorm.news/download/235856...
