https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:30:02.600596+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2020:2755 ALSA-2020:2755 — Important: nghttp2 security update 2026-10-03T04:30:03.373456+00:00

Affected: AlmaLinux:8: libnghttp2, AlmaLinux:8: libnghttp2-devel, AlmaLinux:8: nghttp2

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2020-04461 bdu:2020-04461 2026-10-03T04:30:03.373535+00:00 bdu:2020-04461 https://cve.radiocsirt.org/vuln/bell-cve-2020-11080 Withdrawn: BELL-CVE-2020-11080 — CVE-2020-11080 does not affect BellSoft software 2026-10-03T04:30:03.373554+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-node-2020-11080 BIT-node-2020-11080 — Denial of service in nghttp2 2026-10-03T04:30:03.373571+00:00

Affected: Bitnami: node

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

 https://cve.radiocsirt.org/vuln/cleanstart-2024-ib47069 CLEANSTART-2024-IB47069 — In nghttp2 before version 1 2026-10-03T04:30:03.373595+00:00

Affected: CleanStart: nghttp2

Security vulnerability affects the nghttp2 package. In nghttp2 before version 1.

 https://cve.radiocsirt.org/vuln/cnvd-2021-31262 cnvd-2021-31262 2026-10-03T04:30:03.373613+00:00 cnvd-2021-31262 https://cve.radiocsirt.org/vuln/euvd-2026-243497 EUVD-2026-243497 2026-10-03T04:30:03.373626+00:00 EUVD-2026-243497 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11080 fkie_cve-2020-11080 2026-10-03T04:30:03.373637+00:00

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

 https://cve.radiocsirt.org/vuln/gsd-2020-11080 gsd-2020-11080 2026-10-03T04:30:03.373661+00:00 gsd-2020-11080 https://cve.radiocsirt.org/vuln/icsa-22-090-02 ICSA-22-090-02 — Hitachi Energy e-mesh EMS 2026-10-03T04:30:03.373672+00:00

A vulnerability exists in a specific Node.js function, which could allow various kinds of memory corruption and cause a denial-of-service condition.CVE-2020-8174 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is vulnerable to a Use After Free bug in its TLS implementation. This could cause corruption of memory leading to a denial-of-service condition.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is vulnerable to an error in the HTTP/2 session frame, which is limited to 32 settings by default. An attacker could consume all available CPU resources causing a denial-of-service condition.CVE-2020-11080 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is affected by too many connection attempts with an unknown protocol. This could allow an attacker to cause a denial-of-service condition.CVE-2021-22883 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

 https://cve.radiocsirt.org/vuln/msrc_cve-2020-11080 msrc_CVE-2020-11080 — Denial of service in nghttp2 2026-10-03T04:30:03.373700+00:00 msrc_CVE-2020-11080 https://cve.radiocsirt.org/vuln/opensuse-su-2020:0802-1 openSUSE-SU-2020:0802-1 — Security update for nodejs8 2026-10-03T04:30:03.373716+00:00

Security update for nodejs8

 https://cve.radiocsirt.org/vuln/rhsa-2020:2523 RHSA-2020:2523 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.2 servicemesh-proxy security update 2026-10-03T04:30:03.373731+00:00

nghttp2: overly large SETTINGS frames can lead to DoS

 https://cve.radiocsirt.org/vuln/suse-su-2020:1568-1 SUSE-SU-2020:1568-1 — Security update for nodejs10 2026-10-03T04:30:03.373746+00:00

Security update for nodejs10

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-11080 UBUNTU-CVE-2020-11080 2026-10-03T04:30:03.373762+00:00

Affected: Ubuntu:Pro:16.04:LTS: nghttp2, Ubuntu:Pro:18.04:LTS: nghttp2, Ubuntu:20.04:LTS: nghttp2

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1374 WID-SEC-W-2023-1374 — Node.js: Mehrere Schwachstellen 2026-10-03T04:30:03.373787+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Angriff durchzuführen, Sicherheitsmechanismen zu umgehen oder seine Privilegien zu erweitern.