GHSA-cjcg-cxmh-9wcr: Praxis affected by HTTP/2 Bomb
Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations on the server.
References
- access.redhat.com/security/vulnerabilities/RHSB-2026-007
- blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
- github.com/advisories/GHSA-cjcg-cxmh-9wcr
- github.com/praxis-proxy/praxis/commit/2bb7b29d6992fc2d8045628475912d734e6bee97
- github.com/praxis-proxy/praxis/releases/tag/v0.5.2
- github.com/praxis-proxy/praxis/security/advisories/GHSA-cjcg-cxmh-9wcr
Code Behaviors & Features
Detect and mitigate GHSA-cjcg-cxmh-9wcr with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →