Afuzz

Afuzz - An automated web path fuzzing tool Afuzz is an automated web path fuzzing tool for the Bug Bounty projects. Afuzz is being actively developed by @rapiddns Features Afuzz automatically detects the development language used by the website, and generates extensions according to the language...

emp3r0r

emp3r0r Linux-first multi-operator C2 built to stay quiet and keep working. Self-healing mesh with assisted discovery, in-memory execution with encrypted storage, scriptable agents, cross-platform BOFs, SOCKS5 pivoting, an AI-driven OPSEC-screened MCP server, and a modular C agent delivered by a...

http2-rst-stream-attacker

CVE-2023-44487 and http2-rst-stream-attacker CVE-2023-44487 CVE-2023-44487 is an exploit against the HTTP2 protocol itself. In HTTP2, requests for data are initiated by sending a HEADERS frame. After receiving this frame, a server will start processing your request, subsequently sending DATA fram...

CVE-2024-27983-nodejs-http2

This repository builds up a vulnerable HTTP2 Node.js server server-nossl.js based on CVE-2024-27983 which exploits a continuation flood vulnerability in HTTP2 servers. Notes: server.js is found not vulnerable due to the use of SSL certificates. server-nossl.js is vulnerable to the continuation...

apachedos

This tool uses CVE-2016-8740 to crash servers running Apache HTTPD 2.4.17 - 2.4.23 that support HTTP2. It crashes these servers by forcing them to allocate insanely large amounts of RAM, making the computer unuasable. It can be downloaded here you will need to run it from the command line Usage:...

go-fdo-client security update

An update is available for go-fdo-client. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list go-fdo-client is the device-side implementation of FIDO Device Onboard...

netty-http2-check

netty-http2-check Offline checker for the 7io.netty:netty-codec-http2 CVEs. Tells you which ones you are actually exposed to — and the single version that fixes all of them: 4.1.136.Final / 4.2.16.Final, a number that appears on none of the seven advisories. CVE-2025-55163 · CVE-2026-33871 ·...

CLSA-2026-1794467083 TuxCare security update for io.netty:netty-codec-http2 (1 CVE)

TuxCare rebuilt io.netty:netty-codec-http2 to address 1 CVE. Fixed in 4.1.128.Final-tuxcare.6...

SUSE SLES15 Security Update : terraform-provider-susepubliccloud (SUSE-SU-2026:5169-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:5169-1 advisory. This update for terraform-provider-susepubliccloud fixes the following issue: - CVE-2026-78669: golang.org/x/net/http2: excessive CPU...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Security update for distribution

This update for distribution fixes the following issues: CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control bsc1277966. CVE-2026-41178:...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

RHCOS 4 : OpenShift Container Platform 4.15.71 (RHSA-2026:95754)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95754 advisory. - golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-25681 -...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issue: CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes bsc1285200. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:5169-1 Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issue: - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes bsc1285200...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.60 security and extras update

Red Hat OpenShift Container Platform release 4.17.60 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.71 security and extras update

Red Hat OpenShift Container Platform release 4.15.71 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a security impact of...

ROS-20261110-73-0140

The vulnerability in the Go programming language’s net/http, net/http/internal/http2, and golang.org/x/net/http2 packages is related to asymmetric resource consumption. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...