Skip to content
Threat Feed

Tag

Http2

2 briefs RSS
medium advisory

Suricata HTTP2 Continuation Frame Flooding Denial of Service (CVE-2026-31935)

A denial of service vulnerability, CVE-2026-31935, exists in Suricata versions prior to 7.0.15 and 8.0.4, where flooding the system with crafted HTTP2 continuation frames leads to memory exhaustion and process termination.

cve dos http2 suricata
2r 1t 1c
high advisory

Netty HTTP/2 CONTINUATION Frame Flood Denial of Service

A denial of service vulnerability exists in Netty's HTTP/2 server implementation where an unauthenticated user can exhaust server CPU resources by sending a flood of CONTINUATION frames with zero-byte payloads, bypassing size-based mitigations and leading to service unavailability with minimal bandwidth usage; affected versions include netty-codec-http2 < 4.1.132.Final and netty-codec-http2 versions >= 4.2.0.Alpha1 and < 4.2.10.Final.

denial-of-service http2 netty cve-2026-33871
1r