CVE Vulnerability Catalog

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.

Security advisory GHSA-2hw4-c9m4-f2fj concerns the knative/pkg component. Verification on 2026-05-19 confirmed end-to-end amplification of 4.5×, worse than the advisory's conservative 2× claim. A Go proof of concept (cmd/poc-c2/main.go) was built.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.