| CVE-2026-97032 |
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78660 |
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78663 |
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream…
|
9.1
Critical
|
Oct 8, 2026 |
| CVE-2026-78669 |
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78659 |
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-39821 |
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
|
9.6
Critical
|
May 22, 2026 |