When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 7, 2026 | Aug 13, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-testsUpgrade golang-sharedUpgrade golang-binUpgrade golang-srcUpgrade golang-miscUpgrade golang | Sep 1, 2026 | Aug 13, 2026 |
| Redhat_linux | — | Upgrade ignition-debugsourceUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade opentelemetry-collectorUpgrade slirp4netns-debuginfoUpgrade crunUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade container-selinuxUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade rhcUpgrade grafanaUpgrade osbuild-composer-worker-debuginfoUpgrade flightctl-servicesUpgrade criu-develUpgrade golang-binUpgrade flightctl-agentUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfoUpgrade python3-criuUpgrade grafana-debugsourceUpgrade slirp4netnsUpgrade critUpgrade go-fdo-server-debuginfoUpgrade ignition-validateUpgrade buildah-debugsourceUpgrade ipp-usb-debuginfoUpgrade go-fdo-server-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade osbuild-composerUpgrade containernetworking-plugins-debugsourceUpgrade flightctl-selinuxUpgrade libslirp-debuginfoUpgrade conmon-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-debugsourceUpgrade go-fdo-server-rendezvousUpgrade podman-testsUpgrade go-fdo-serverUpgrade osbuild-composer-workerUpgrade libslirp-develUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debuginfoUpgrade rhc-debuginfoUpgrade podman-pluginsUpgrade flightctl-observabilityUpgrade containernetworking-plugins-debuginfoUpgrade delveUpgrade podman-debuginfoUpgrade go-toolsetUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade udicaUpgrade golang-docsUpgrade image-builder-debuginfoUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade runcUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade golang-raceUpgrade grafana-pcpUpgrade cockpit-podmanNo solution existsUpgrade osbuild-composer-debuginfoUpgrade grafana-pcp-debugsourceUpgrade skopeoUpgrade golang-srcUpgrade buildahUpgrade ignition-grubUpgrade grafana-pcp-debuginfoUpgrade ignition-edgeUpgrade golangUpgrade runc-debugsourceUpgrade rhc-debugsourceUpgrade toolboxUpgrade libslirpUpgrade podman-catatonitUpgrade conmonUpgrade ignition-validate-debuginfoUpgrade delve-debugsourceUpgrade image-builder-debugsourceUpgrade image-builderUpgrade rhc-worker-playbookUpgrade skopeo-debugsourceUpgrade podmanUpgrade criuUpgrade containers-commonUpgrade aardvark-dnsUpgrade rhc-worker-playbook-debuginfoUpgrade go-fdo-server-ownerUpgrade python3-podmanUpgrade toolbox-testsUpgrade ignitionUpgrade criu-debuginfoUpgrade podman-gvproxyUpgrade golang-miscUpgrade go-fdo-server-manufacturerUpgrade fuse-overlayfs-debugsourceUpgrade delve-debuginfoUpgrade criu-libsUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade flightctl-cliUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade ipp-usbUpgrade grafana-debuginfoUpgrade golang-testsUpgrade crun-debugsourceUpgrade buildah-testsUpgrade grafana-selinuxUpgrade ignition-debuginfoUpgrade rhc-worker-playbook-debugsourceUpgrade podman-dockerUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade osbuild-composer-core | Aug 17, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade toolbox-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-composer-workerUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade crunUpgrade slirp4netns-debuginfoUpgrade delveUpgrade golang-binUpgrade osbuild-composer-debuginfoUpgrade ipp-usb-debuginfoUpgrade crun-debuginfoUpgrade ipp-usbUpgrade libslirp-debugsourceUpgrade slirp4netns-debugsourceUpgrade conmon-debuginfoUpgrade osbuild-composerUpgrade critUpgrade skopeo-debuginfoUpgrade grafanaUpgrade oci-seccomp-bpf-hookUpgrade osbuild-composer-debugsourceUpgrade criu-libs-debuginfoUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade go-fdo-serverUpgrade podman-gvproxy-debuginfoUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade slirp4netnsUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade crun-debugsourceUpgrade podman-debuginfoUpgrade opentelemetry-collectorUpgrade runcUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafana-debugsourceUpgrade libslirp-develUpgrade criu-libsUpgrade go-toolsetUpgrade podman-gvproxyUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-testsUpgrade buildahUpgrade image-builder-debuginfoUpgrade grafana-pcp-debugsourceUpgrade golangUpgrade osbuild-composer-coreUpgrade image-builderUpgrade image-builder-debugsourceUpgrade grafana-pcp-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade golang-raceUpgrade go-fdo-server-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade grafana-selinuxUpgrade fuse-overlayfsUpgrade grafana-debuginfoUpgrade conmon-debugsourceUpgrade conmonUpgrade toolbox-testsUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade buildah-debugsourceUpgrade criu-debuginfoUpgrade criuUpgrade grafana-pcpUpgrade delve-debuginfoUpgrade criu-debugsourceUpgrade toolboxUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-catatonitUpgrade podmanUpgrade libslirpUpgrade go-fdo-server-debuginfoUpgrade aardvark-dnsUpgrade netavark | Aug 28, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub