io.undertow:undertow-http2-test-suite (1.3.0.cr1), io.undertow:undertow-servlet (1.3.0.cr1) +49 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.3.0.cr1)

io.undertow:undertow-core MAVEN version 1.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr1 - io.undertow:undertow-servlet 1.3.0.cr1 -...

io.undertow:undertow-http2-test-suite (1.1.0.beta8), io.undertow:undertow-servlet (1.1.0.beta8) +1 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.1.0.beta8)

io.undertow:undertow-core MAVEN version 1.1.0.beta8 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.1.0.beta8 - io.undertow:undertow-servlet 1.1.0.beta8 -...

io.undertow:undertow-http2-test-suite (1.2.0.cr1), io.undertow:undertow-servlet (1.2.0.cr1) +11 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.0.cr1)

io.undertow:undertow-core MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.cr1 - io.undertow:undertow-servlet 1.2.0.cr1 -...

io.undertow:undertow-http2-test-suite (1.3.1.final), io.undertow:undertow-servlet (1.3.1.final) +1 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.3.1.final)

io.undertow:undertow-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.1.final - io.undertow:undertow-servlet 1.3.1.final -...

io.undertow:undertow-http2-test-suite (1.2.0.beta7), io.undertow:undertow-servlet (1.2.0.beta7) +1 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.0.beta7)

io.undertow:undertow-core MAVEN version 1.2.0.beta7 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta7 - io.undertow:undertow-servlet 1.2.0.beta7 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta9), io.undertow:undertow-servlet (1.2.0.beta9) +1 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.0.beta9)

io.undertow:undertow-core MAVEN version 1.2.0.beta9 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta9 - io.undertow:undertow-servlet 1.2.0.beta9 -...

io.undertow:undertow-http2-test-suite (1.2.2.final), io.undertow:undertow-servlet (1.2.2.final) +2 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.2.final)

io.undertow:undertow-core MAVEN version 1.2.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.2.final - io.undertow:undertow-servlet 1.2.2.final -...

io.mangoo:mangooio-core (>=1.1.0-rc1, <=1.1.0-rc2), io.mangoo:mangooio-integration-test (>=1.1.0-rc1, <=1.1.0-rc2) +10 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.11.final)

io.undertow:undertow-core MAVEN version 1.2.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.mangoo:mangooio-core =1.1.0-rc1, =1.1.0-rc1, =1.1.0-rc1, =1.1.0-rc1, =2.1.0, =15.11.1, =15.11.1,...

io.undertow:undertow-http2-test-suite (1.3.0.beta12), io.undertow:undertow-servlet (1.3.0.beta12) +1 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.3.0.beta12)

io.undertow:undertow-core MAVEN version 1.3.0.beta12 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta12 - io.undertow:undertow-servlet 1.3.0.beta12 -...

io.undertow:undertow-http2-test-suite (1.3.0.cr2), io.undertow:undertow-servlet (1.3.0.cr2) +52 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.3.0.cr2)

io.undertow:undertow-core MAVEN version 1.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr2 - io.undertow:undertow-servlet 1.3.0.cr2 -...

io.inkstand:inkstand-deployment-resteasy (>=0.1.1, <=0.1.2), io.inkstand:inkstand-http-undertow (>=0.1.1, <=0.1.2) +8 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.0.beta3)

io.undertow:undertow-core MAVEN version 1.2.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:inkstand-deployment-resteasy =0.1.1, =0.1.1, =0.0.1, =0.0.1, =4.0.0, =1.0.0.alpha11,...

io.undertow:undertow-http2-test-suite (1.3.0.cr3), io.undertow:undertow-servlet (1.3.0.cr3) +1 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.3.0.cr3)

io.undertow:undertow-core MAVEN version 1.3.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr3 - io.undertow:undertow-servlet 1.3.0.cr3 -...

golang.org/x/net/http vulnerable to a reset flood

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of stream...

golang.org/x/net/http vulnerable to ping floods

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU,...

GHSA-HGR8-6H9X-F7Q9 golang.org/x/net/http vulnerable to ping floods

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU,...

co.paralleluniverse:comsat-test-utils (0.2.0), io.undertow:undertow-http2-test-suite (>=1.1.0.beta7, <=1.1.0.beta8) +4 more potentially affected by CVE-2014-7816 via io.undertow:undertow-core (>=1.1.0.beta1, <=1.1.0.cr4)

io.undertow:undertow-core MAVEN version =1.1.0.beta1, =1.1.0.beta7, =1.1.0.beta1, =1.1.0.beta1, =1.0.0.alpha1, =1.0.0.alpha8 Source cves: CVE-2014-7816 Source advisory: GHSA-H6P6-FC4W-CQHX...

io.undertow:undertow-http2-test-suite (>=1.2.0.beta1, <=1.2.0.beta2), io.undertow:undertow-servlet (>=1.2.0.beta1, <=1.2.0.beta2) +2 more potentially affected by CVE-2014-7816 via io.undertow:undertow-core (>=1.2.0.beta1, <=1.2.0.beta2)

io.undertow:undertow-core MAVEN version =1.2.0.beta1, =1.2.0.beta1, =1.2.0.beta1, =1.2.0.beta1, =1.0.0.alpha9, =1.0.0.alpha10 Source cves: CVE-2014-7816 Source advisory: OSV:GHSA-H6P6-FC4W-CQHX...

GHSA-H3Q4-6J7F-R24C priority vulnerable to denial of service

A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority informati...

io.undertow:undertow-http2-test-suite (1.2.0.beta9), io.undertow:undertow-servlet (1.2.0.beta9) +1 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.2.0.beta9)

io.undertow:undertow-core MAVEN version 1.2.0.beta9 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta9 - io.undertow:undertow-servlet 1.2.0.beta9 -...

io.undertow:undertow-http2-test-suite (1.1.0.beta7), io.undertow:undertow-servlet (1.1.0.beta7) +3 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.1.0.beta7)

io.undertow:undertow-core MAVEN version 1.1.0.beta7 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.1.0.beta7 - io.undertow:undertow-servlet 1.1.0.beta7 -...