Puh4Ck3Rx

When built with `USE HTTP2` and `enable http2` enabled, the software contains a use-after-free issue in the `handle http2()` function. This occurs because the system retains freed `:method` and `:path` pointers. An unauthenticated remote attacker can send a subsequent HEADERS frame that omits these pseudo-headers to manipulate the request method or path evaluated by access rules, or cause the server to crash. A use-after-free is a memory corruption issue where an application continues to use a pointer after it has been freed, potentially leading to arbitrary code execution or system instability.

Insecure default variable initialization allows an unauthorized remote attacker to bypass a security feature, specifically authentication, over a network.

Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network.

Improper verification of the source of a communication channel allows an unauthorized attacker on an adjacent network to bypass a security feature.