nginx:1.26 security update

1.26.3-9.0.1.3 - Require oracle-indexhtml 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and...

Oracle Linux 10 : nginx (ELSA-2026-59220)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59220 advisory. - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217956 ...

CVE-2026-68763: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

nginx:1.24 security update

1.24.0-3.4.0.1 - Remove Red Hat references Orabug: 29498217 1:1.24.0-3.4 - Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and denial of service in ngxhttpslicemodule CVE-2026-60005 - Resolves: RHEL-219309 - nginx:1.24/nginx: NGINX: Heap buffer over-read allows memory...

ROOT-OS-DEBIAN-13-CVE-2026-58055 CVE-2026-58055 in nghttp2 - Patched by Root

Root has patched CVE-2026-58055 in the nghttp2 package for Root:Debian:13. Multiple fixed versions available...

Important: Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

An update for .NET 9.0 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

Important: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

An update for .NET 8.0 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

PT-2026-81074

Name of the Vulnerable Software and Affected Versions libwebsockets affected versions not specified Description An issue exists in the parsing of the HTTP/2 HPACK path header due to insufficient validation of user-supplied data. This flaw can lead to an out-of-bounds write, where data is written...

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper...

RHEL 9 : .NET 8.0 (RHSA-2026:58569)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58569 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios-1.12.2.tgz (CVE-2026-25639, CVE-2026-39865)

Summary Axios is vulnerable to a Improper Check for Unusual or Exceptional Conditions Complete Denial of Service DoS, Uncontrolled Resource Consumption forcefully crashing the client application backend attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details...

Exploit for Memory Allocation with Excessive Size Value in Apache Http_Server

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

CVE-2026-74836

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-75484

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...