159 matches found
AZL-37478 CVE-2023-39325 affecting package golang for versions less than 1.21.6-1
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
Google Golang Resource Management Error Vulnerability
Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...
CVE-2023-41768
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability...
AZL-31299 CVE-2023-44487 affecting package cmake for versions less than 3.21.4-10
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31312 CVE-2023-44487 affecting package influxdb for versions less than 2.6.1-11
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34825 CVE-2023-44487 affecting package kata-containers for versions less than 3.1.0-8
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35441 CVE-2023-44487 affecting package docker-compose for versions less than 2.27.0-1
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34568 CVE-2023-44487 affecting package blobfuse2 for versions less than 2.1.0-4
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-37404 CVE-2023-44487 affecting package golang for versions less than 1.21.6-1
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34819 CVE-2023-44487 affecting package jx for versions less than 3.2.236-13
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34997 CVE-2023-44487 affecting package moby-containerd-cc for versions less than 1.7.1-5
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31296 CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31297 CVE-2023-44487 affecting package cf-cli for versions less than 8.4.0-13
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35038 CVE-2023-44487 affecting package node-problem-detector for versions less than 0.8.10-16
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c
A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges...
gRPC 安全漏洞
gRPC is a modern, open-source, high-performance Remote Procedure Call RPC framework from gRPC Open Source. A security vulnerability exists in gRPC, which stems from the ability to call abort functions via http2...
kernel: Bluetooth: L2CAP: Fix memory leak in vhci_write
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix memory leak in vhciwrite Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810d81ac00 size 240: ... hex dump first 32 bytes: 00 00 ...
golang: net/http: handle server errors after sending GOAWAY
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...