Ubuntu fixes HAProxy regression on 22.04 after security update
The earlier fix for truncated HTTP/2 PING handling could exhaust CPU; the follow-up corrects a chunked-request regression.
Stories per day · 30 days
4 RSS
Relatedapache-tomcat4denial-of-service4curl3cve-2026-923923libcurl3use-after-free3ajp2authentication-bypass2haproxy2rce2ubuntu2anthropic1dos1http1.11http2shell1https-proxy1ids1incomplete-cleanup1
31 stories, newest first · one card per story
Stories tagged #http2
HAProxy allows denial of service via HTTP/2 PING frames (CVE-2026-110353)
Remote attackers can trigger CPU exhaustion and denial of service in HAProxy servers through malformed HTTP/2 PING frames.
Suricata before 8.0.8 fixes multiple high-severity denial-of-service flaws
Listed issues cover CPU and memory exhaustion and a crash in TFTP, SIP, HTTP/2 and DoH2.
http2shell claimed as RCE in Node, Python, and more
The Hacker News item only shows a title plus 49 points and 10 comments, with no versions or exploit status.
Ubuntu patches libsoup3 flaws on 26.10 in USN-8890-2
The notice backports earlier libsoup fixes, including an HTTP/2 denial of service and an HTTPS proxy information leak.
Apache Tomcat flaws allow auth bypass and data exposure
Eight issues span three branches; Important fixes are in Tomcat 11.0.27, 10.1.61 and 9.0.123, with no exploitation stated.
4
Apache Tomcat patches eight flaws, including a password bypass
Fixes shipped in 11.0.27, 10.1.61 and 9.0.123; three issues are Important and no active exploitation is reported.
6
Tomcat HTTP/2 async flaw can mix users' requests (CVE-2026-101356)
Apache rates the issue important; the excerpt lists three affected version ranges and no fix.
Tomcat HTTP/2 trailer headers can leak into the next request
Apache rates the incomplete cleanup low; fixed releases are not named in the posted notice.
[SECURITY ADVISORIES] curl 8.23.0
curl 8.23.0 fixes high-severity HTTP/2 upload use-after-free CVE-2026-92392.
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
curl 8.23.0 fixes high-severity HTTP/2 use-after-free CVE-2026-92392 after a PoC showed client code execution.
A UAF turned RCE
curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 use-after-free that can lead to RCE.
Fwd: Vulnerabilities in golang.org/x/net
Go released golang.org/x/net v0.60.0 to fix HTTP/2 server memory exhaustion caused by Trailer headers.
Fwd: Go 1.27.2 and Go 1.26.9 are released
Go released 1.27.2 and 1.26.9 with security fixes, including an HTTP/2 net/http server issue.
USN-8900-1: Go Networking vulnerabilities
Ubuntu patches Go networking flaws that can hang HTTP/2 connections or exhaust resources via HPACK.
USN-8893-1: Libwebsockets vulnerabilities
Ubuntu fixed two libwebsockets buffer overflows that could crash systems or run code.
USN-8890-1: libsoup vulnerabilities
Ubuntu fixed libsoup flaws that could cause denial of service, leak proxy data, or bypass security checks.
USN-8869-1: RabbitMQ Server vulnerability
Ubuntu warns RabbitMQ mishandles HTTP/2 headers, possibly letting attackers exhaust memory and cause a denial of service.
Apache HTTP Server Flaws Enable Remote Code Execution and Denial-of-Service Attacks
Apache urges HTTP Server 2.4.68 after flaws that can enable code execution, source disclosure, and denial of service.
11
Axios HTTP/2 Flaws Enable SSRF Control Bypass and Node.js Denial of Service
Axios HTTP/2 bugs CVE-2026-101898 and CVE-2026-101901 allow SSRF-control bypass and Node.js denial of service.
Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks
Axios disclosed seven high-severity flaws, including HTTP/2 SSRF proxy bypass; attackers could reach internal services and cloud metadata; patched in 1.20.0.
USN-8820-1: curl vulnerabilities
Ubuntu patched curl flaws that may bypass LDAP peer checks or allow HTTP/2 crashes and code execution.
Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
A Tomcat regression of the CVE-2026-41293 fix can mix HTTP/2 request headers.