967 matches found
SUSE CVE-2024-7708
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak...
Fixed in Apache Tomcat 10.1.59
Note: The issues below were fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for these issues, version 10.1.58 is not included in the list of affected version...
Fixed in Apache Tomcat 11.0.25
Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...
Fixed in Apache Tomcat 9.0.121
Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...
CVE-2026-52880
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-52880
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-52880
Klever-Go REST API (seednode and node) in versions 1.7.14–1.7.17 is affected by a denial-of-service via slow-header connections. The issue stems from Gin Engine.Run using Go’s default http.ListenAndServe with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes, allowing an unauthenticated client...
CVE-2026-65324
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad...
EUVD-2026-50206
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad...
CVE-2026-65324 Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad...
PT-2026-65736
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad...
Fixed in Apache Tomcat 10.1.58
Low: DoS in WebSocket chat example CVE-2026-66299 The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process. This was fixed...
Linux Distros Unpatched Vulnerability : CVE-2026-52684
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolv...
SUSE CVE-2026-52684
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...
CVE-2026-44909
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
CVE-2026-44909
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
EUVD-2026-48310
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...