PT-2026-87053

Name of the Vulnerable Software and Affected Versions Jetty versions prior to 9.4.58-6.1 Description A race condition occurs when the server handles RST STREAM and GOAWAY frames sent by a client. This condition resets the HTTP2Flusher.terminated variable to a null value, which allows entries to b...

CVE-2026-12611: Uncontrolled Resource Consumption

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

UBUNTU-CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the cleanup process when handling HTTP/2 Server Push streams with the parenthandle configured to share connections with other handles. An attacker can execute arbitrary code or cause a denial of service by triggering...

CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99780 CVE-2026-18924 affecting package cmake 3.30.3-15

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99879 CVE-2026-18924 affecting package tensorflow 2.16.1-11

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99801 CVE-2026-18924 affecting package mysql 8.0.46-1

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99764 CVE-2026-18924 affecting package curl 8.11.1-11

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99834 CVE-2026-18924 affecting package rust 1.75.0-30

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

ALPINE-CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99858 CVE-2026-18924 affecting package rust 1.90.0-10

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924

A use-after-free vulnerability exists in libcurl due to a flaw in how it handles HTTP/2 Server Push streams. This issue occurs when a parent handle is configured to share connections with other handles, leading to a memory corruption flaw during the cleanup process. A remote attacker could potent...

CVE-2026-18924 HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924 HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

EUVD-2026-72165

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...