httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

CVE-2026-73934: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of th...

Red Hat Security Advisory 2026-55804-03

Red Hat Security Advisory 2026-55804-03 - An update for nghttp2 is now available for Red Hat Enterprise Linux 8...

PT-2026-78176

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to unauthorized access to critic...

Oracle Linux 9 : haproxy (ELSA-2026-55772)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-55772 advisory. - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204 Resolves: RHEL-211082 Tenable has extracted the preceding description block directly...

CVE-2026-73935: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of thi...

CVE-2026-73896: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of thi...

CVE-2026-73890: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of thi...

PT-2026-78185

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to unauthorized read access to a...

PT-2026-78223

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.1 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a frequently...

PT-2026-78179

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a frequently...

PT-2026-78222

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 3.2.19 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a frequently...

CVE-2026-73887: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of thi...

KLA91234 SB vulnerabilities in Apache Tomcat

Security bypass vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to bypass security restrictions. Below is a complete list of vulnerabilities: 1. Security vulnerability can be exploited to bypass security restrictions. 2. Security vulnerability in...

PT-2026-78225

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a complete Denial of Service...

ROS-20260818-73-0006

The vulnerability of the HTTP/2 implementation in the Go programming language is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

MiracleLinux 9 : dotnet9.0-9.0.119-1.el9_8.ML.1 (AXSA:2026-1557:15)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1557:15 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

RHEL 9 : mod_http2 (RHSA-2026:55930)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55930 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...

RockyLinux 8 : haproxy (RLSA-2026:55859)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55859 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...

Oracle Linux 8 : haproxy (ELSA-2026-55859)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-55859 advisory. 1.8.27-5.2 - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204, RHEL-211083 Tenable has extracted the preceding description block directly from the...