CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-79829 HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

CVE-2026-79829 HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

EUVD-2026-101999

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

CVE-2026-79829

A security vulnerability exists in HPE NonStop HTTP WEBSERVER (specifically version T1144 - T1144L24^AAL and earlier) where memory corruption can occur, potentially resulting in a system halt . The vulnerability is associated with CWE-20 (Improper Input Validation). HPE has released fixes; for ex...

CVE-2026-18659

In Eclipse Jetty, across various versions of "jetty-security", and "jetty-eeN-security", and "jetty-eeN-servlet", the Jakarta Spec constraints defined as "http-method-omission" can be bypassed by using substrings of the defined HTTP Methods...

EUVD-2026-101996

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18659 Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-18662

In Eclipse Jetty, across various versions of "jetty-security", and "jetty-eeN-security", two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previo...

EUVD-2026-101995

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-109855

A flaw was found in undici. A malicious remote server can cause a Denial of Service DoS by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream ope...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the experimental WebSocket client, where a response failing handshake validation triggers an abort that is a no-op because the request is already...

DEBIAN-CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...