Skip to content
Threat Feed
Subscribe

Tag

Http2

5 briefs RSS
medium threat

CVE-2026-41227: F5 Networks Traffic Management Microkernel (TMM) Process Termination via HTTP/2 Traffic

CVE-2026-41227 describes a vulnerability in an F5 Networks product where undisclosed traffic on an HTTP/2 virtual server with Layer 7 DoS Protection enabled can lead to increased memory consumption and termination of the Traffic Management Microkernel (TMM) process.

dos cve http2
2r 1t 1c
critical advisory

Apache HTTP Server HTTP/2 Protocol Vulnerability Could Allow for Remote Code Execution

A vulnerability in Apache HTTP Server's HTTP/2 protocol can lead to denial of service by crashing worker processes, and in specific configurations (APR with mmap), remote code execution.

HTTP Server apache http2 rce dos webserver
2r 2t
medium advisory

Plug.Cowboy HTTP/2 Atom Table Exhaustion DoS

An unauthenticated remote denial-of-service vulnerability in Plug.Cowboy allows attackers to exhaust the BEAM atom table via HTTP/2 requests, crashing the Erlang VM.

plug_cowboy +1 denial-of-service http2 atom-exhaustion
2r 1t 1c
medium advisory

Suricata HTTP2 Continuation Frame Flooding Denial of Service (CVE-2026-31935)

A denial of service vulnerability, CVE-2026-31935, exists in Suricata versions prior to 7.0.15 and 8.0.4, where flooding the system with crafted HTTP2 continuation frames leads to memory exhaustion and process termination.

cve dos http2 suricata
2r 1t 1c
high advisory

Netty HTTP/2 CONTINUATION Frame Flood Denial of Service

A denial of service vulnerability exists in Netty's HTTP/2 server implementation where an unauthenticated user can exhaust server CPU resources by sending a flood of CONTINUATION frames with zero-byte payloads, bypassing size-based mitigations and leading to service unavailability with minimal bandwidth usage; affected versions include netty-codec-http2 < 4.1.132.Final and netty-codec-http2 versions >= 4.2.0.Alpha1 and < 4.2.10.Final.

denial-of-service http2 netty cve-2026-33871
1r