PT-2026-120964

Name of the Vulnerable Software and Affected Versions HAProxy versions 3.2 through 3.4.5 Description A remote unauthenticated attacker can cause a denial of service resulting in worker-thread CPU exhaustion by sending a truncated HTTP/2 PING frame. The function h2c handle ping in src/mux h2.c fai...

Red Hat: CVE-2026-110353: haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

CLEANSTART-2026-BX90561 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...

haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

A flaw was found in HAProxy. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a truncated HTTP/2 PING frame. Because the server fails to properly validate and process the incomplete frame, the pending data is never consumed, causing worker threads to spin continuous...

CVE-2026-111373

A flaw was found in FreeRDP. A malicious gateway or remote server can trigger a Denial of Service DoS by sending a zero-length WebSocket ping message to a connected client. When processing this empty payload, the application encounters an invalid null memory reference, triggering an assertion...

Linux Distros Unpatched Vulnerability : CVE-2026-109932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood o...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker ca...

CVE-2026-109932

A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service DoS by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket...

DEBIAN-CVE-2026-109932

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-109932

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-109932

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

PT-2026-115121

Name of the Vulnerable Software and Affected Versions undici versions 5.15.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The WebSocket client in this HTTP client library for Node.js can be forced to exhaust process memory by a malicious or...

CVE-2026-101959

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping...

CVE-2026-101959 Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping...

CVE-2026-101959

A Function Call With Incorrect Variable or Reference as Argument vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . An unauthenticated adjacent attacker can exploit this flaw by sending a specifically malformed LSP-ping , resulting in an ...

EUVD-2026-101311

A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping...

CVE-2026-102054

An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP...

CVE-2026-102054 Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured

An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP...

EUVD-2026-101378

An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP...