https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:22:28.349187+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338561 EUVD-2026-338561 2026-10-06T01:22:28.351482+00:00 EUVD-2026-338561 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54340 fkie_cve-2026-54340 2026-10-06T01:22:28.351519+00:00

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54340 UBUNTU-CVE-2026-54340 2026-10-06T01:22:28.351564+00:00

Affected: Ubuntu:Pro:18.04:LTS: h2o, Ubuntu:Pro:20.04:LTS: h2o, Ubuntu:Pro:22.04:LTS: h2o, Ubuntu:24.04:LTS: h2o, Ubuntu:Pro:24.04:LTS: dnsdist

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.