CVE 追蹤：全部

[HIGH 7.5] CVE-2026-115482 — Amplification

Thu, 22 Oct 2026 19:17:48 +0000

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-770
比對：Amplification（關鍵字 amplification attack|reflection attack）
NVD 狀態：Deferred｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

[CRITICAL 9.2] CVE-2026-111497 — Brotli

Thu, 22 Oct 2026 19:17:35 +0000

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVSS 4.0：9.2 CRITICAL（CNA）
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE：CWE-252, CWE-787
比對：Brotli（關鍵字 Google Brotli）
NVD 狀態：Awaiting Analysis｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

[HIGH 7.5] CVE-2026-110354 — HAProxy

Thu, 22 Oct 2026 19:17:35 +0000

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-835
比對：HAProxy（關鍵字 ^\s*(In )?HAProxy\b）
NVD 狀態：Awaiting Analysis｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81

[HIGH 7.5] CVE-2026-110353 — HAProxy

Thu, 22 Oct 2026 19:17:35 +0000

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-252
比對：HAProxy（關鍵字 ^\s*(In )?HAProxy\b）
NVD 狀態：Awaiting Analysis｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

https://git.haproxy.org/?p=haproxy.git;a=commit;h=cec63e95f62a7412484f1134f5aa227e5b7e1466

[HIGH 7.5] CVE-2026-19630 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-407
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[HIGH 8.1] CVE-2026-94300 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：8.1 HIGH（CNA）
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE：CWE-362, CWE-415
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[HIGH 7.5] CVE-2026-96888 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-476, CWE-617
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[HIGH 7.5] CVE-2026-97313 — BIND

Thu, 22 Oct 2026 17:36:46 +0000

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-617
比對：BIND（關鍵字 (?-i:\bBIND ?9\b)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T17:36

參考連結：

[CRITICAL 9.1] CVE-2025-31699 — Apache Traffic Server