Search: “http2”

16 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 5 Exploit / PoC 3 Industry 3 Phishing & fraud 1 Malware 1 Ransomware 1 Research 1 Tools 1

SeverityAll critical 3 high 2 medium 6 low 5 info 0

CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.

oss-securitySep 7, 18:45 UTC · 8d agoVulnerability CVE-2026-16028

Critical Apache HTTP/2 Flaw (CVE-2026

The Hacker NewsMay 5, 16:46 UTC · May 5, 2026Exploit / PoC CVE-2026-23918

ShadowV2 Botnet Exposes Rise of DDoS-as-a

Infosecurity MagazineSep 24, 16:00 UTC · Sep 24, 2025Malware

Secure websites brought to you by the letter S

Help Net SecurityDec 20, 14:48 UTC · Dec 20, 2016Industry

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

The Hacker NewsJun 10, 14:36 UTC · Jun 10, 2026Vulnerability CVE-2016-6581 CVE-2025-53020 CVE-2016-8740+3 CVEs

Inside DDoSia: NoName057(16)’s Pro

Recorded FutureJul 10, 00:00 UTC · Jul 10, 2025Ransomware

Google Project Zero expert found 3 flaws in Apache Web Server

Security AffairsAug 25, 08:09 UTC · Aug 25, 2020Vulnerability CVE-2020-9490 CVE-2020-11984 CVE-2020-11993

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.

Researchers named the two techniques HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), exploiting the gap where CDNs speak HTTP/3 to browsers but only HTTP/1.1 to origins. All six tested CDNs (Alibaba, Baidu, Cloudflare, CloudFront, Fastly, Tencent) were susceptible to HBA, and five to HCA, with Cloudflare immune to HCA because it buffers full requests before opening backend connections. Attackers using under 5 Mbps forced over 100 Mbps at origins, and the 350x factor applies only to Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Testing identified 42,330 potentially vulnerable subdomains out of 151,685 hosted on the six providers across the Tranco Top 1M.

The Hacker NewsAug 20, 11:39 UTC · 26d agoResearch