CVE-2026-78669
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Oct 8, 2026
CISA due date
—
The record
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a… CWE-405
- CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the header… CWE-405
- CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should… CWE-405
- CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS… CWE-405
- CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. CWE-405
- CVE-2026-54874 Issue summary: Receiving a DTLS record for a future epoch while a handshake is in… CWE-405
- CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend… CWE-405
- CVE-2026-72914 Mastodon is a free, open-source social network server based on ActivityPub. CWE-405