RSS
Last updated: May 14, 2026 at 10:49 AM UTC
All 219 Vulnerability 76 Breach 45 Threat 91 Defense 7
Tag: dos (2 articles)Clear
vulnerability
CVE-2026-20188
2026-05-06

Cisco network management products have a flaw that lets attackers crash them remotely - victims need to manually reboot the device to recover (CVE-2026-20188)

Cisco patched a high-severity denial-of-service flaw in Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO) that lets unauthenticated remote attackers exhaust connection resources and force the system into an unresponsive state. CVE-2026-20188. Recovery requires manual reboot. Cisco's PSIRT has not seen exploitation in the wild yet, but Cisco previously patched similar DoS bugs (CVE-2025-20362, CVE-2025-20333) that ended up being weaponized to force ASA and FTD firewalls into reboot loops, which CISA addressed with an emergency directive in November 2025.

ciscocncnsodosmanual-reboothigh-severitynetwork-orchestrationcrossworkservice-provider
Check
Inventory Cisco CNC and Cisco NSO instances. Check whether their management interfaces are reachable from untrusted networks. Set up monitoring alerts for connection-resource exhaustion on these systems.
Affected
Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO) running unpatched versions. CVE-2026-20188, high severity. The DoS condition requires manual reboot to recover, meaning a successful attack creates extended outages. Service-provider and enterprise customers using Cisco network orchestration are in scope.
Fix
Upgrade Cisco CNC and NSO to fixed versions per Cisco's advisory. Restrict management interfaces to trusted internal networks. Implement rate limiting at the network edge to throttle connection attempts to CNC/NSO ports. Document recovery procedures including console access for manual reboot - a remote-only management plan fails if the box itself becomes unreachable.
vulnerability
CVE-2026-23918CVE-2026-24072CVE-2026-28780CVE-2026-29168CVE-2026-29169
2026-05-05

Apache web server has a critical flaw in HTTP/2 that crashes servers and could let attackers run code (CVE-2026-23918)

Apache patched a double-free vulnerability in mod_http2 yesterday. CVE-2026-23918 (CVSS 8.8) lets a remote attacker crash the server immediately, with a path to remote code execution under specific memory-layout conditions. The bug is in the stream cleanup code in h2_mplx.c and is triggered by a crafted sequence of HTTP/2 frames including an early stream reset. mod_http2 ships in default Apache builds and HTTP/2 is widely enabled in production. The MPM prefork worker is not affected. Researchers warn practical RCE requires an info leak and probabilistic heap spray, but in lab conditions execution lands in minutes.

apachehttp2mod_http2double-freercedoscvss-8-8striga-aiisecapache-http-server
Check
Identify Apache HTTP Server 2.4.66 installations. Run 'httpd -v' or 'apache2 -v' on each server, and check whether mod_http2 is enabled with 'apache2ctl -M | grep http2'.
Affected
Apache HTTP Server 2.4.66 with mod_http2 enabled (default in most builds). CVE-2026-23918, CVSS 8.8. The MPM prefork worker is not affected; MPM event and worker (default in modern installs) are vulnerable. No public proof-of-concept yet but exploitation is straightforward for DoS. Internet-facing Apache servers running HTTP/2 are at acute risk.
Fix
Upgrade to Apache HTTP Server 2.4.67. If immediate upgrade isn't possible, disable mod_http2 with 'a2dismod http2' - but this drops HTTP/2 support entirely. The 2.4.67 release also patches mod_rewrite (CVE-2026-24072), mod_proxy_ajp (CVE-2026-28780), mod_md, and mod_dav_lock - apply all fixes together.