| CVE-2026-97032 |
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78660 |
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78663 |
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream…
|
9.1
Critical
|
Oct 8, 2026 |
| CVE-2026-78669 |
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-78659 |
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the…
|
7.5
High
|
Oct 8, 2026 |
| CVE-2026-33814 |
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it…
|
7.5
High
|
May 7, 2026 |
| CVE-2026-27141 |
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
|
7.5
High
|
Feb 26, 2026 |
| CVE-2023-45288 |
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of…
|
7.5
High
|
Apr 4, 2024 |
| CVE-2023-39325 |
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource…
|
Not rated
|
Oct 11, 2023 |
| CVE-2022-41723 |
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a…
|
7.5
High
|
Feb 28, 2023 |
| CVE-2022-41717 |
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
|
Not rated
|
Dec 8, 2022 |