github.com/apple/swift-nio-http2
SwiftURL
SEMVER · introduced 0 → fixed 1.28.0
GHSA-qppj-fm5r-hxr3Published
HTTP/2 Stream Cancellation Attack
Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-qppj-fm5r-hxr3
Publishedgolang.org/x/net
Go
SEMVER · introduced 0 → fixed 0.17.0
org.apache.tomcat:tomcat-coyote
Maven
ECOSYSTEM · introduced 11.0.0-M1 → fixed 11.0.0-M12
9 explicitly affected versions
11.0.0-M1, 11.0.0-M10, 11.0.0-M11, 11.0.0-M3, 11.0.0-M4, 11.0.0-M5, 11.0.0-M6, 11.0.0-M7, 11.0.0-M9
org.apache.tomcat:tomcat-coyote
Maven
ECOSYSTEM · introduced 10.0.0 → fixed 10.1.14
48 explicitly affected versions
10.0.0, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.16, 10.0.17, 10.0.18, 10.0.2, 10.0.20, 10.0.21, 10.0.22, 10.0.23, 10.0.26, 10.0.27, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11, 10.1.0-M12, 10.1.0-M14, 10.1.0-M15, 10.1.0-M16, 10.1.0-M17, 10.1.0-M2, 10.1.0-M4, 10.1.0-M5, 10.1.0-M6, 10.1.0-M7, 10.1.0-M8, 10.1.1, 10.1.10, 10.1.11, 10.1.12, 10.1.13, 10.1.2, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.1.8, 10.1.9
org.apache.tomcat:tomcat-coyote
Maven
ECOSYSTEM · introduced 9.0.0 → fixed 9.0.81
64 explicitly affected versions
9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.16, 9.0.17, 9.0.19, 9.0.2, 9.0.20, 9.0.21, 9.0.22, 9.0.24, 9.0.26, 9.0.27, 9.0.29, 9.0.30, 9.0.31, 9.0.33, 9.0.34, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.4, 9.0.40, 9.0.41, 9.0.43, 9.0.44, 9.0.45, 9.0.46, 9.0.48, 9.0.5, 9.0.50, 9.0.52, 9.0.53, 9.0.54, 9.0.55, 9.0.56, 9.0.58, 9.0.59, 9.0.6, 9.0.60, 9.0.62, 9.0.63, 9.0.64, 9.0.65, 9.0.67, 9.0.68, 9.0.69, 9.0.7, 9.0.70, 9.0.71, 9.0.72, 9.0.73, 9.0.74, 9.0.75, 9.0.76, 9.0.78, 9.0.79, 9.0.8, 9.0.80
org.apache.tomcat:tomcat-coyote
Maven
ECOSYSTEM · introduced 8.5.0 → fixed 8.5.94
78 explicitly affected versions
8.5.0, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 8.5.16, 8.5.19, 8.5.2, 8.5.20, 8.5.21, 8.5.23, 8.5.24, 8.5.27, 8.5.28, 8.5.29, 8.5.3, 8.5.30, 8.5.31, 8.5.32, 8.5.33, 8.5.34, 8.5.35, 8.5.37, 8.5.38, 8.5.39, 8.5.4, 8.5.40, 8.5.41, 8.5.42, 8.5.43, 8.5.45, 8.5.46, 8.5.47, 8.5.49, 8.5.5, 8.5.50, 8.5.51, 8.5.53, 8.5.54, 8.5.55, 8.5.56, 8.5.57, 8.5.58, 8.5.59, 8.5.6, 8.5.60, 8.5.61, 8.5.63, 8.5.64, 8.5.65, 8.5.66, 8.5.68, 8.5.69, 8.5.70, 8.5.71, 8.5.72, 8.5.73, 8.5.75, 8.5.76, 8.5.77, 8.5.78, 8.5.79, 8.5.8, 8.5.81, 8.5.82, 8.5.83, 8.5.84, 8.5.85, 8.5.86, 8.5.87, 8.5.88, 8.5.89, 8.5.9, 8.5.90, 8.5.91, 8.5.92, 8.5.93
org.apache.tomcat.embed:tomcat-embed-core
Maven
ECOSYSTEM · introduced 11.0.0-M1 → fixed 11.0.0-M12
9 explicitly affected versions
11.0.0-M1, 11.0.0-M10, 11.0.0-M11, 11.0.0-M3, 11.0.0-M4, 11.0.0-M5, 11.0.0-M6, 11.0.0-M7, 11.0.0-M9
org.apache.tomcat.embed:tomcat-embed-core
Maven
ECOSYSTEM · introduced 10.0.0 → fixed 10.1.14
48 explicitly affected versions
10.0.0, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.16, 10.0.17, 10.0.18, 10.0.2, 10.0.20, 10.0.21, 10.0.22, 10.0.23, 10.0.26, 10.0.27, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11, 10.1.0-M12, 10.1.0-M14, 10.1.0-M15, 10.1.0-M16, 10.1.0-M17, 10.1.0-M2, 10.1.0-M4, 10.1.0-M5, 10.1.0-M6, 10.1.0-M7, 10.1.0-M8, 10.1.1, 10.1.10, 10.1.11, 10.1.12, 10.1.13, 10.1.2, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.1.8, 10.1.9
org.apache.tomcat.embed:tomcat-embed-core
Maven
ECOSYSTEM · introduced 9.0.0 → fixed 9.0.81
64 explicitly affected versions
9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.16, 9.0.17, 9.0.19, 9.0.2, 9.0.20, 9.0.21, 9.0.22, 9.0.24, 9.0.26, 9.0.27, 9.0.29, 9.0.30, 9.0.31, 9.0.33, 9.0.34, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.4, 9.0.40, 9.0.41, 9.0.43, 9.0.44, 9.0.45, 9.0.46, 9.0.48, 9.0.5, 9.0.50, 9.0.52, 9.0.53, 9.0.54, 9.0.55, 9.0.56, 9.0.58, 9.0.59, 9.0.6, 9.0.60, 9.0.62, 9.0.63, 9.0.64, 9.0.65, 9.0.67, 9.0.68, 9.0.69, 9.0.7, 9.0.70, 9.0.71, 9.0.72, 9.0.73, 9.0.74, 9.0.75, 9.0.76, 9.0.78, 9.0.79, 9.0.8, 9.0.80
org.apache.tomcat.embed:tomcat-embed-core
Maven
ECOSYSTEM · introduced 8.5.0 → fixed 8.5.94
78 explicitly affected versions
8.5.0, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 8.5.16, 8.5.19, 8.5.2, 8.5.20, 8.5.21, 8.5.23, 8.5.24, 8.5.27, 8.5.28, 8.5.29, 8.5.3, 8.5.30, 8.5.31, 8.5.32, 8.5.33, 8.5.34, 8.5.35, 8.5.37, 8.5.38, 8.5.39, 8.5.4, 8.5.40, 8.5.41, 8.5.42, 8.5.43, 8.5.45, 8.5.46, 8.5.47, 8.5.49, 8.5.5, 8.5.50, 8.5.51, 8.5.53, 8.5.54, 8.5.55, 8.5.56, 8.5.57, 8.5.58, 8.5.59, 8.5.6, 8.5.60, 8.5.61, 8.5.63, 8.5.64, 8.5.65, 8.5.66, 8.5.68, 8.5.69, 8.5.70, 8.5.71, 8.5.72, 8.5.73, 8.5.75, 8.5.76, 8.5.77, 8.5.78, 8.5.79, 8.5.8, 8.5.81, 8.5.82, 8.5.83, 8.5.84, 8.5.85, 8.5.86, 8.5.87, 8.5.88, 8.5.89, 8.5.9, 8.5.90, 8.5.91, 8.5.92, 8.5.93
org.eclipse.jetty.http2:http2-common
Maven
ECOSYSTEM · introduced 9.3.0 → fixed 9.4.53
118 explicitly affected versions
9.3.0.v20150612, 9.3.1.v20150714, 9.3.10.M0, 9.3.10.v20160621, 9.3.11.M0, 9.3.11.v20160721, 9.3.12.v20160915, 9.3.13.M0, 9.3.13.v20161014, 9.3.14.v20161028, 9.3.15.v20161220, 9.3.16.v20170120, 9.3.17.RC0, 9.3.17.v20170317, 9.3.18.v20170406, 9.3.19.v20170502, 9.3.2.v20150730, 9.3.20.v20170531, 9.3.21.M0, 9.3.21.RC0, 9.3.21.v20170918, 9.3.22.v20171030, 9.3.23.v20180228, 9.3.24.v20180605, 9.3.25.v20180904, 9.3.26.v20190403, 9.3.27.v20190418, 9.3.28.v20191105, 9.3.29.v20201019, 9.3.3.v20150827, 9.3.30.v20211001, 9.3.4.RC0, 9.3.4.RC1, 9.3.4.v20151007, 9.3.5.v20151012, 9.3.6.v20151106, 9.3.7.RC0, 9.3.7.RC1, 9.3.7.v20160115, 9.3.8.RC0, 9.3.8.v20160314, 9.3.9.M0, 9.3.9.M1, 9.3.9.v20160517, 9.4.0.M0, 9.4.0.M1, 9.4.0.RC0, 9.4.0.RC1, 9.4.0.RC2, 9.4.0.RC3, 9.4.0.v20161208, 9.4.0.v20180619, 9.4.1.v20170120, 9.4.1.v20180619, 9.4.10.RC0, 9.4.10.RC1, 9.4.10.v20180503, 9.4.11.v20180605, 9.4.12.RC0, 9.4.12.RC1, 9.4.12.RC2, 9.4.12.v20180830, 9.4.13.v20181111, 9.4.14.v20181114, 9.4.15.v20190215, 9.4.16.v20190411, 9.4.17.v20190418, 9.4.18.v20190429, 9.4.19.v20190610, 9.4.2.v20170220, 9.4.2.v20180619, 9.4.20.v20190813, 9.4.21.v20190926, 9.4.22.v20191022, 9.4.23.v20191118, 9.4.24.v20191120, 9.4.25.v20191220, 9.4.26.v20200117, 9.4.27.v20200227, 9.4.28.v20200408, 9.4.29.v20200521, 9.4.3.v20170317, 9.4.3.v20180619, 9.4.30.v20200611, 9.4.31.v20200723, 9.4.32.v20200930, 9.4.33.v20201020, 9.4.34.v20201102, 9.4.35.v20201120, 9.4.36.v20210114, 9.4.37.v20210219, 9.4.38.v20210224, 9.4.39.v20210325, 9.4.4.v20170414, 9.4.4.v20180619, 9.4.40.v20210413, 9.4.41.v20210516, 9.4.42.v20210604, 9.4.43.v20210629, 9.4.44.v20210927, 9.4.45.v20220203, 9.4.46.v20220331, 9.4.47.v20220610, 9.4.48.v20220622, 9.4.49.v20220914, 9.4.5.v20170502, 9.4.5.v20180619, 9.4.50.v20221201, 9.4.51.v20230217, 9.4.52.v20230823, 9.4.6.v20170531, 9.4.6.v20180619, 9.4.7.RC0, 9.4.7.v20170914, 9.4.7.v20180619, 9.4.8.v20171121, 9.4.8.v20180619, 9.4.9.v20180320
org.eclipse.jetty.http2:http2-common
Maven
ECOSYSTEM · introduced 10.0.0 → fixed 10.0.17
17 explicitly affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.16, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
org.eclipse.jetty.http2:http2-common
Maven
ECOSYSTEM · introduced 11.0.0 → fixed 11.0.17
17 explicitly affected versions
11.0.0, 11.0.1, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.14, 11.0.15, 11.0.16, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9
org.eclipse.jetty.http2:http2-server
Maven
ECOSYSTEM · introduced 9.3.0 → fixed 9.4.53
118 explicitly affected versions
9.3.0.v20150612, 9.3.1.v20150714, 9.3.10.M0, 9.3.10.v20160621, 9.3.11.M0, 9.3.11.v20160721, 9.3.12.v20160915, 9.3.13.M0, 9.3.13.v20161014, 9.3.14.v20161028, 9.3.15.v20161220, 9.3.16.v20170120, 9.3.17.RC0, 9.3.17.v20170317, 9.3.18.v20170406, 9.3.19.v20170502, 9.3.2.v20150730, 9.3.20.v20170531, 9.3.21.M0, 9.3.21.RC0, 9.3.21.v20170918, 9.3.22.v20171030, 9.3.23.v20180228, 9.3.24.v20180605, 9.3.25.v20180904, 9.3.26.v20190403, 9.3.27.v20190418, 9.3.28.v20191105, 9.3.29.v20201019, 9.3.3.v20150827, 9.3.30.v20211001, 9.3.4.RC0, 9.3.4.RC1, 9.3.4.v20151007, 9.3.5.v20151012, 9.3.6.v20151106, 9.3.7.RC0, 9.3.7.RC1, 9.3.7.v20160115, 9.3.8.RC0, 9.3.8.v20160314, 9.3.9.M0, 9.3.9.M1, 9.3.9.v20160517, 9.4.0.M0, 9.4.0.M1, 9.4.0.RC0, 9.4.0.RC1, 9.4.0.RC2, 9.4.0.RC3, 9.4.0.v20161208, 9.4.0.v20180619, 9.4.1.v20170120, 9.4.1.v20180619, 9.4.10.RC0, 9.4.10.RC1, 9.4.10.v20180503, 9.4.11.v20180605, 9.4.12.RC0, 9.4.12.RC1, 9.4.12.RC2, 9.4.12.v20180830, 9.4.13.v20181111, 9.4.14.v20181114, 9.4.15.v20190215, 9.4.16.v20190411, 9.4.17.v20190418, 9.4.18.v20190429, 9.4.19.v20190610, 9.4.2.v20170220, 9.4.2.v20180619, 9.4.20.v20190813, 9.4.21.v20190926, 9.4.22.v20191022, 9.4.23.v20191118, 9.4.24.v20191120, 9.4.25.v20191220, 9.4.26.v20200117, 9.4.27.v20200227, 9.4.28.v20200408, 9.4.29.v20200521, 9.4.3.v20170317, 9.4.3.v20180619, 9.4.30.v20200611, 9.4.31.v20200723, 9.4.32.v20200930, 9.4.33.v20201020, 9.4.34.v20201102, 9.4.35.v20201120, 9.4.36.v20210114, 9.4.37.v20210219, 9.4.38.v20210224, 9.4.39.v20210325, 9.4.4.v20170414, 9.4.4.v20180619, 9.4.40.v20210413, 9.4.41.v20210516, 9.4.42.v20210604, 9.4.43.v20210629, 9.4.44.v20210927, 9.4.45.v20220203, 9.4.46.v20220331, 9.4.47.v20220610, 9.4.48.v20220622, 9.4.49.v20220914, 9.4.5.v20170502, 9.4.5.v20180619, 9.4.50.v20221201, 9.4.51.v20230217, 9.4.52.v20230823, 9.4.6.v20170531, 9.4.6.v20180619, 9.4.7.RC0, 9.4.7.v20170914, 9.4.7.v20180619, 9.4.8.v20171121, 9.4.8.v20180619, 9.4.9.v20180320
org.eclipse.jetty.http2:http2-server
Maven
ECOSYSTEM · introduced 10.0.0 → fixed 10.0.17
17 explicitly affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.16, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
org.eclipse.jetty.http2:http2-server
Maven
ECOSYSTEM · introduced 11.0.0 → fixed 11.0.17
17 explicitly affected versions
11.0.0, 11.0.1, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.14, 11.0.15, 11.0.16, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9
org.eclipse.jetty.http2:jetty-http2-common
Maven
ECOSYSTEM · introduced 12.0.0 → fixed 12.0.2
2 explicitly affected versions
12.0.0, 12.0.1
org.eclipse.jetty.http2:jetty-http2-server
Maven
ECOSYSTEM · introduced 12.0.0 → fixed 12.0.2
2 explicitly affected versions
12.0.0, 12.0.1
com.typesafe.akka:akka-http-core
Maven
ECOSYSTEM · introduced 0 → fixed 10.5.3
1 explicitly affected versions
3.0.0-RC1
com.typesafe.akka:akka-http-core_2.13
Maven
ECOSYSTEM · introduced 0 → fixed 10.5.3
31 explicitly affected versions
10.1.10, 10.1.11, 10.1.12, 10.1.13, 10.1.14, 10.1.15, 10.1.8, 10.1.9, 10.2.0, 10.2.0-M1, 10.2.0-RC1, 10.2.0-RC2, 10.2.1, 10.2.10, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.5-M1, 10.2.5-M2, 10.2.6, 10.2.7, 10.2.8, 10.2.9, 10.4.0, 10.4.0-M1, 10.4.0-M2, 10.5.0, 10.5.0-M1, 10.5.1, 10.5.2
com.typesafe.akka:akka-http-core_2.12
Maven
ECOSYSTEM · introduced 0 → fixed 10.5.3
59 explicitly affected versions
10.0.0, 10.0.0-RC2, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.6+7-e2ba6752, 10.0.7, 10.0.8, 10.0.9, 10.1.0, 10.1.0-RC1, 10.1.0-RC2, 10.1.1, 10.1.10, 10.1.11, 10.1.12, 10.1.13, 10.1.14, 10.1.15, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.1.8, 10.1.9, 10.2.0, 10.2.0-M1, 10.2.0-RC1, 10.2.0-RC2, 10.2.1, 10.2.10, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.5-M1, 10.2.5-M2, 10.2.6, 10.2.7, 10.2.8, 10.2.9, 10.4.0, 10.4.0-M1, 10.4.0-M2, 10.5.0, 10.5.0-M1, 10.5.1, 10.5.2
com.typesafe.akka:akka-http-core_2.11
Maven
ECOSYSTEM · introduced 0 → last_affected 10.1.15
58 explicitly affected versions
10.0.0, 10.0.0-RC2, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.6+7-e2ba6752, 10.0.7, 10.0.8, 10.0.9, 10.1.0, 10.1.0-RC1, 10.1.0-RC2, 10.1.1, 10.1.10, 10.1.11, 10.1.12, 10.1.13, 10.1.14, 10.1.15, 10.1.2, 10.1.3, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.1.8, 10.1.9, 2.4-ARTERY-M1, 2.4-ARTERY-M2, 2.4-ARTERY-M3, 2.4-ARTERY-M4, 2.4.10, 2.4.11, 2.4.11.1, 2.4.11.2, 2.4.2, 2.4.2-RC1, 2.4.2-RC2, 2.4.2-RC3, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.9-RC1, 2.4.9-RC2, 3.0.0-RC1
Original source record · Cite this exact observation · Complete original publisher JSON