redhat/http2-common vulnerabilities

Latest redhat/http2-common CVEs

Newest publication first

1. CVE-2026-12611 org.eclipse.jetty.http2/http2-common: org.eclipse.jetty.http2/jetty-http2-common: Jetty: Denial of Service via HTTP/2 race condition

   Published 2026-09-08

   High·CVSS 8.7 EPSS 0.43%

   A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.