CWE-675 vulnerabilities

CVE-2026-78663 is a critical vulnerability in the Go standard library net/http package affecting HTTP/2 servers. It allows a malicious client to bypass the configured connection-level flow control limit by causing the server to refund flow control credits twice for the same data. This occurs when a client resets a stream and the request handler subsequently reads buffered data, resulting in double refunding of connection-level flow control. Although total buffered data remains limited by concurrent stream limits and stream-level flow control, this flaw can lead to denial of service or resource exhaustion.

NLnet Labs Unbound versions 1.20.0 through 1.26.0 contain a vulnerability in the 'serve-expired' code path that allows a double decrement of the 'wait-limit' counter per client IP. This flaw can be exploited by an attacker controlling an authoritative zone with short TTLs to bypass a DNS query rate-limiting countermeasure introduced for DNSBomb (CVE-2024-33655). The attacker can maintain the per-client counter at or below the configured limit indefinitely, allowing an arbitrary number of pending queries from a single source IP. The vulnerability has a CVSS score of 3.7 and is classified as medium severity.