Project

General

Profile

Actions
Copy link

Security #8946

closed
OT PA

http2: parser desync on HEADERS frame without END_HEADERS flag (8.0.x backport)

Security #8946: http2: parser desync on HEADERS frame without END_HEADERS flag (8.0.x backport)

Added by OISF Ticketbot 2 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.7
Affected Versions:
Label:
CVE:
Git IDs:

0794dc6a0a70fcf7caf6a587d8777c65e9009254

Severity:
MODERATE
Disclosure Date:
11/02/2026
GHSA:
GHSA-wcfh-g7m3-63vr

JI Updated by Jason Ish 2 months ago Actions
Copy link
 #1

  • Severity set to MODERATE

Apply severity from parent ticket: MODERATE.

JI Updated by Jason Ish 2 months ago Actions
Copy link
 #2

  • GHSA set to GHSA-wcfh-g7m3-63vr

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
 #3

  • Subject changed from http2: HEADERS-without-END_HEADERS reassembly stores Pad-Length/Priority prefix and trailing padding as HPACK data (8.0.x backport) to http2: parser desync on HEADERS frame without END_HEADERS flag (8.0.x backport)

JI Updated by Jason Ish about 2 months ago Actions
Copy link
 #4

  • Disclosure Date set to 11/02/2026

PA Updated by Philippe Antoine about 2 months ago Actions
Copy link
 #5

  • Status changed from Assigned to Resolved

staged

JI Updated by Jason Ish about 2 months ago Actions
Copy link
 #6

Philippe Antoine wrote in #note-5:

staged

Now its staged :)

JI Updated by Jason Ish about 2 months ago Actions
Copy link
 #7

  • Git IDs updated (diff)

JI Updated by Jason Ish about 1 month ago Actions
Copy link
 #8

  • Status changed from Resolved to Closed

JI Updated by Jason Ish about 1 month ago Actions
Copy link
 #9

  • Private changed from Yes to No
Actions
Copy link

Also available in: PDF Atom