https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T10:46:09.946675+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-78663 BELL-CVE-2026-78663 2026-10-18T10:46:09.955393+00:00

Affected: Alpaquita:23: go, Alpaquita:stream: docker, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-78663 BIT-golang-2026-78663 — Double flow control refund on HTTP/2 server streams in net/http 2026-10-18T10:46:09.955446+00:00

Affected: Bitnami: golang

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-en61439 CLEANSTART-2026-EN61439 — HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (ref… 2026-10-18T10:46:09.955473+00:00

Affected: CleanStart: kube-logging-operator

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.

 https://cve.radiocsirt.org/vuln/euvd-2026-384930 EUVD-2026-384930 2026-10-18T10:46:09.955497+00:00 EUVD-2026-384930 https://cve.radiocsirt.org/vuln/fkie_cve-2026-78663 fkie_cve-2026-78663 2026-10-18T10:46:09.955509+00:00

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-78663 UBUNTU-CVE-2026-78663 2026-10-18T10:46:09.955531+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:16.04:LTS: juju-core, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: containerd, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:Pro:16.04:LTS: google-guest-agent and 67 more

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.