AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-56853

HIGH · CVSS 7.5 EPSS 0.22%

Source: NVD + CISA KEV + EPSS · Published 2026-08-13 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

Servers configured to support unencrypted HTTP/2 are vulnerable due to the improper application of the ReadHeaderTimeout during the initial connection phase, which could allow for denial-of-service conditions. This oversight may lead to resource exhaustion if an attacker sends a large number of connections without completing the handshake. Organizations utilizing HTTP/2 should prioritize addressing this vulnerability to mitigate potential service disruptions.

CVE
CVE-2026-56853
Severity
HIGH
CVSS
7.5
EPSS
0.22%

Original NVD Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.