HTTP
10 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for HTTP, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
HTTP CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 1 |
Severity
How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High3
- Medium5
Latest CVEs
The 10 most recently published vulnerabilities affecting HTTP.
- CVE-2026-84997react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU7.5
- CVE-2026-3256HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids9.8
- CVE-2026-3255HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function6.5
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.7.5
- CVE-2023-26044ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits5.3
- CVE-2022-36032ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent5.3
- CVE-2019-25009An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.9.8
- CVE-2020-35669An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HT...6.1
- CVE-2020-25574An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).7.5
- CVE-2015-1828The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.5.9
Product grouping is registry-driven, with AI assist and human review. How it works