CLEANSTART-2026-DQ31365 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server)

CVE-2022-21628 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Lightweight HTTP Server. See references for individual vulnerability details...

CLEANSTART-2026-LJ66214 llhttp parser in the http module in Node v20

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

SUSE CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CLEANSTART-2026-QW98383 Undici is an HTTP/1

Security vulnerability affects the openjdk21 package. Undici is an HTTP/1...

CLEANSTART-2026-BM42059 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the openjdk21 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-GY77159 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-QI90513 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-QG19683 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-ZY41765 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-IE92648 client may issue specially crafted HTTP/1

Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

CVE-2026-105659: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

PT-2026-122310

Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...

PT-2026-114425

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When processing an HTTP redirect to a URL containing userinfo a username:password component, curl may incorrectly retain and re-transmit the HTTP Negotiate authentication state from the original...

CVE-2026-102479: Inconsistent Interpretation of HTTP Requests

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130138)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130138 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-60021): Gitea -- multiple vulnerabilities

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...