149077 matches found
CVE-2026-105659
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
CVE-2026-105659
The mtrudel bandit library (version 1.4.0 and onward) is vulnerable to an Uncontrolled Resource Consumption vulnerability. An unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by sending a trickle of small WINDOW_UPDATE frames. The root cause is that the Bandit.HTTP2.Co...
EUVD-2026-101380
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
EEF-CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Summary Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer...
CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
CVE-2026-105659
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty
Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-93492 DESCRIPTION: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2...
CVE-2026-59951
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...
CVE-2026-91881
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...
EnergizeLab AI Station software supply chain vulnerability issues
EnergizeLab AI Station has a software supply chain vulnerability. This vulnerability stems from downloading firmware updates via plaintext HTTP, without verifying their integrity and authenticity. This could allow attackers to replace malicious updates by intercepting or modifying traffic...
kiboit phastpress server-side request forgeing vulnerability
Kiboit Phastpress versions 3.10 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the scripts service endpoint dynamically constructing URL whitelists based on HTTP host headers controlled by attackers. Unauthenticated attackers can forge these headers t...
Mat Trudel Bandit has a vulnerability in input validation.
In versions prior to 1.13.0 of Mat Trudel Bandit, version 0.6.0, there was an input validation vulnerability. This vulnerability stemmed from the lack of validation for the authority in HTTP/1 requests. As a result, unauthenticated remote attackers could set conn.host and conn.port to values that...
ReactPHP HTTP resource management error vulnerabilities
The ReactPHP HTTP version 1.0.0 to 1.11.1 have a resource management vulnerability. This vulnerability arises from ClientRequestStream::handleData, which allows the response headers to be appended to the internal buffer without any size restrictions. A remote server can exploit this vulnerability...
SODOLA SL902-SWTGW124AS Buffer Error Vulnerability
The SODOLA SL902-SWTGW124AS models released before version 200.2.12 have a buffer error vulnerability. This vulnerability stems from a buffer overflow in the firmware. Unauthenticated remote attackers can exploit this vulnerability by sending an excessively large boundary value in the Content-Typ...
Eclipse Jetty authorization issue vulnerability
Eclipse Jetty has an authorization issue vulnerability. This vulnerability arises because a constraint defined as http-method-omission in the Jakarta specification can be bypassed by using substrings of predefined HTTP methods, potentially leading to circumvention of access control restrictions...
ALPINE-CVE-2026-95101
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...
AZL-108449 CVE-2026-95101 affecting package nginx for versions less than 1.30.6-1
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...
CVE-2026-95101
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...