SECURITY Signal 272 2 feeds carried it
Wednesday, July 29, 2026 Security Releases
Two of the High-severity flaws allow remote attackers to exhaust memory or trigger heap-use-after-free on any exposed HTTP/2 server without authentication. The Permission Model over-grant issue means workloads relying on --permission for filesystem sandboxing may have been allowing access outside intended allowlists.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846) and re-entrant send can cause heap-use-after-free (CVE-2026-56848), both rated High and exploitable remotely.
The Permission Model's radix-tree prefix boundary handling can over-grant filesystem access (CVE-2026-58043, High), and trace events can write outside --allow-fs-write paths (CVE-2026-56847, Low).
Medium-severity fixes address mTLS identity reuse across PFX certificates, skipped hostname verification on TLS session reuse, SQLite iterator replay re-executing writes, dns.resolveAny() abort on DNS responses with over 256 A records, and zlib crashes from spoofed TypedArray lengths.
THE CLUSTER