Severity by source
Network-accessible unauthenticated attack using standard protocol frames with no interaction required; sole impact is availability with no confidentiality or integrity loss.
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Memory exhaustion and denial-of-service across HTTP/2 server implementations allow remote unauthenticated attackers to crash or severely degrade affected services by intentionally stalling flow control using standard HTTP/2 protocol frames. Researched and reported by the Okta Red Team and coordinated through CERT/CC as VU#885548, this class of vulnerability is tracked across three CVEs (CVE-2026-59762, CVE-2026-59173, CVE-2026-44909) affecting multiple vendor implementations including F5 BIG-IP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target server must be running an HTTP/2 implementation that does not enforce memory ceilings on buffered response data and does not terminate connections that remain flow-control-stalled beyond a configurable duration - this is the specific vulnerable configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is high for any organization exposing HTTP/2-capable servers directly to the internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker opens many simultaneous HTTP/2 connections to a publicly accessible web server, on each connection opening the protocol-maximum number of concurrent streams and issuing requests for large resources such as file downloads or bulk API responses. Immediately after sending requests, the attacker transmits a SETTINGS frame advertising SETTINGS_INITIAL_WINDOW_SIZE=0 and ceases sending any WINDOW_UPDATE frames, legally freezing the server's ability to transmit response data on all active streams. … |
| Remediation | Several vendors have released patches addressing implementations covered by the VU#885548 disclosure; consult CERT/CC VU#885548 at https://kb.cert.org/vuls/id/885548 for the full vendor matrix and individual fix references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of F5 BIG-IP and all HTTP/2-enabled servers in your environment, identify internet-facing deployments, and enable HTTP/2 protocol logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today