CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

EUVD-2026-107172

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CVE-2026-56386

The Apache bRPC HTTP/2 server DATA frame parser is vulnerable to an integer underflow and out-of-bounds read . The issue arises because the handler decrements the fragment size when the PADDED flag is set before verifying the presence of the mandatory pad length byte. An unauthenticated remote at...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

EUVD-2026-107169

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

CVE-2026-54425

Apache bRPC versions before 1.18.0 are vulnerable to a denial of service (DoS) due to uncontrolled recursion (CWE-674) in the HTTP/2 HPACK decoder. An attacker can send a crafted HTTP/2 header block with many consecutive Dynamic Table Size Update entries, causing the decoder to exhaust the thread...

CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

CVE-2026-48830

Apache bRPC versions through 1.17.0 are vulnerable to an improper authentication flaw (CWE-287 ). If ServerOptions.auth is enabled and builtin HTTP services are exposed, an unauthenticated remote attacker can send a builtin HTTP request as the first message on an HTTP/1.1 keep-alive connection. T...

EUVD-2026-107168

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

php-cve-defensive-audit-kit

PHP Defensive Host Audit Kit Safe host-side configuration v...

Denial Of Service (DoS)

io.netty:netty-codec-http3 is vulnerable to Denial of service DoS. The vulnerability is due to QPACK encoder state being retained without limits or being released when HTTP/3 streams complete, which allows a remote, unauthenticated attacker to exhaust server memory by sending sequential HTTP/3...

CVE-2026-57487

A flaw was found in libupnp. The HTTP parser fails to enforce configured message size limits when processing chunked transfer-encoded HTTP requests. A remote attacker can exploit this vulnerability by sending an excessively large chunked payload, forcing the application to buffer data beyond...

SUSE-SU-2026:24368-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. -...

BIT-NGINX-GATEWAY-2026-95101 NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

BIT-NGINX-2026-95101 NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

Exploit for CVE-2026-85317

CVE-2026-85317 — camel-http: OAuth2 token cache confusion Run...

Exploit for CVE-2026-85316

CVE-2026-85316 — camel-platform-http: unintended proxy mode fr...

HTTP Request Authority Confusion

io.netty, netty-codec-http3 is vulnerable to HTTP request authority confusion. The vulnerability is due to the failure to enforce matching authority values, which allows a remote unauthenticated attacker to bypass routing, virtual-host, and access-control restrictions by sending a crafted HTTP/3...