The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Fix
Microsoft's update · Critical
- Release Notes — azl3 cert-manager 1.12.15-14 on Azure Linux 3.0 · build 1.12.15-15
- Release Notes — azl3 cloud-provider-kubevirt 0.5.1-9 on Azure Linux 3.0 · build 0.5.1-10
- Release Notes — azl3 containerized-data-importer 1.62.0-8 on Azure Linux 3.0 · build 1.62.0-9
- Release Notes — azl3 etcd 3.5.33-1 on Azure Linux 3.0 · build 3.5.35-1
- Release Notes — azl3 influxdb 2.7.5-21 on Azure Linux 3.0 · build 2.7.5-22
- Release Notes — azl3 keda 2.14.1-19 on Azure Linux 3.0 · build 2.14.1-22
- Release Notes — azl3 kube-vip-cloud-provider 0.0.10-10 on Azure Linux 3.0 · build 0.0.10-11
- Release Notes — azl3 kubevirt 1.8.4-2 on Azure Linux 3.0 · build 1.8.4-4
- Release Notes — azl3 opa 0.63.0-5 on Azure Linux 3.0 · build 0.63.0-6
- Release Notes — azl3 prometheus-adapter 0.12.0-10 on Azure Linux 3.0 · build 0.12.0-12
- Release Notes — azl3 prometheus-node-exporter 1.7.0-5 on Azure Linux 3.0 · build 1.7.0-6
- Release Notes — azl3 prometheus-process-exporter 0.8.2-5 on Azure Linux 3.0 · build 0.8.2-6
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-29.
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.1NVD modified 2026-10-09 17:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.