CVE-2026-87045

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description An unauthenticated remote attacker can cause a denial of service in the HTTP/2 server. The issue occurs because the handle http frame header() function unconditionally clears the connection stream binding, and the enter http frame continuation state() function fails to re-bind it when processing a CONTINUATION frame. This leads to a null pointer dereference in two specific paths: when send headers frame() is called via send http2 404() or send http2 405() for unregistered resources or unsupported methods, and when handle http2 dynamic resource() processes POST, PUT, or PATCH requests to registered dynamic resources. The vulnerability can be triggered by sending a stray CONTINUATION frame with END HEADERS set or a legitimate split header block. This results in a write to a fixed low memory address, causing the system to fault and halt.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.