https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 12:29:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-109855 <p>undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.</p> <p>undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.</p> https://db.gcve.eu/vuln/fkie_cve-2026-109855 https://db.gcve.eu/vuln/rhsa-2026:76677 <p>google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files grafana: grafana: Denial of Service via oversized Git Sync responses github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy axios: Axios: Information disclosure via improper CIDR proxy bypass handling undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake</p> <p>google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files grafana: grafana: Denial of Service via oversized Git Sync responses github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy axios: Axios: Information disclosure via improper CIDR proxy bypass handling undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake</p> https://db.gcve.eu/vuln/rhsa-2026:76677