https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:40:06 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-09848 bdu:2025-09848 https://cve.radiocsirt.org/vuln/bdu:2025-09848 https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 https://cve.radiocsirt.org/vuln/euvd-2026-260099 EUVD-2026-260099 https://cve.radiocsirt.org/vuln/euvd-2026-260099 https://cve.radiocsirt.org/vuln/fkie_cve-2025-8671 <p>A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.</p> <p>A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-8671 https://cve.radiocsirt.org/vuln/oesa-2025-2166 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: lighttpd</p> <p>Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems. Security Fix(es):</p> <p>A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: lighttpd</p> <p>Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems. Security Fix(es):</p> <p>A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2166 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15448-1 <p>lighttpd-1.4.80-1.1 on GA media</p> <p>lighttpd-1.4.80-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15448-1 https://cve.radiocsirt.org/vuln/rustsec-2025-0070 <p><strong>Affected:</strong> crates.io: pingora-core</p> <p>Pingora deployments using versions prior to 0.6.0 that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.</p> <p>On affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.</p> <p>This issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users are requested to upgrade to versions &gt;= 0.6.0, which incorporates the required fixes.</p> <p><strong>Affected:</strong> crates.io: pingora-core</p> <p>Pingora deployments using versions prior to 0.6.0 that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.</p> <p>On affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.</p> <p>This issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users are requested to upgrade to versions &gt;= 0.6.0, which incorporates the required fixes.</p> https://cve.radiocsirt.org/vuln/rustsec-2025-0070 https://cve.radiocsirt.org/vuln/suse-su-2026:20995-1 <p>Security update for dnsdist</p> <p>Security update for dnsdist</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20995-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-8671 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: lighttpd, Ubuntu:14.04:LTS: varnish, Ubuntu:Pro:16.04:LTS: lighttpd, Ubuntu:Pro:16.04:LTS: varnish, Ubuntu:Pro:18.04:LTS: h2o, Ubuntu:Pro:18.04:LTS: lighttpd, Ubuntu:Pro:18.04:LTS: varnish, Ubuntu:Pro:20.04:LTS: h2o, Ubuntu:20.04:LTS: lighttpd, Ubuntu:Pro:20.04:LTS: varnish and 11 more</p> <p>A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: lighttpd, Ubuntu:14.04:LTS: varnish, Ubuntu:Pro:16.04:LTS: lighttpd, Ubuntu:Pro:16.04:LTS: varnish, Ubuntu:Pro:18.04:LTS: h2o, Ubuntu:Pro:18.04:LTS: lighttpd, Ubuntu:Pro:18.04:LTS: varnish, Ubuntu:Pro:20.04:LTS: h2o, Ubuntu:20.04:LTS: lighttpd, Ubuntu:Pro:20.04:LTS: varnish and 11 more</p> <p>A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-8671 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1830 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiednen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiednen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1830