Количество 14
Количество 14
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/http
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for t ...
openSUSE-SU-2026:22152-1
Security update for go1.26
SUSE-SU-2026:4864-1
Security update for go1.26
openSUSE-SU-2026:22093-1
Security update for go1.27
SUSE-SU-2026:4625-1
Security update for go1.27
RLSA-2026:86203
Important: go-toolset:rhel8 security, bug fix, and enhancement update
RLSA-2026:86196
Important: golang security, bug fix, and enhancement update
RLSA-2026:86093
Important: golang security, bug fix, and enhancement update
SUSE-SU-2026:4867-1
Security update for go1.26-openssl
SUSE-SU-2026:4866-1
Security update for go1.26-openssl
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. | CVSS3: 9.1 | 1% Низкий | 18 дней назад |
 | CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. | CVSS3: 5.3 | 1% Низкий | 18 дней назад |
 | CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. | CVSS3: 9.1 | 1% Низкий | 18 дней назад |
 | CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http | CVSS3: 7.5 | 1% Низкий | 16 дней назад |
| CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for t ... | CVSS3: 9.1 | 1% Низкий | 18 дней назад |
 | openSUSE-SU-2026:22152-1 Security update for go1.26 | 5 дней назад | ||
| SUSE-SU-2026:4864-1 Security update for go1.26 | 4 дня назад | ||
| openSUSE-SU-2026:22093-1 Security update for go1.27 | 13 дней назад | ||
| SUSE-SU-2026:4625-1 Security update for go1.27 | 15 дней назад | ||
 | RLSA-2026:86203 Important: go-toolset:rhel8 security, bug fix, and enhancement update | 6 дней назад | ||
| RLSA-2026:86196 Important: golang security, bug fix, and enhancement update | 5 дней назад | ||
| RLSA-2026:86093 Important: golang security, bug fix, and enhancement update | 5 дней назад | ||
| SUSE-SU-2026:4867-1 Security update for go1.26-openssl | 4 дня назад | ||
| SUSE-SU-2026:4866-1 Security update for go1.26-openssl | 4 дня назад |
Уязвимостей на страницу