#rce

A race between HTTP/2 HEADERS and RST_STREAM frames lets unauthenticated clients double-free a stream pool inside mod_http2's h2_mplx.c. We dissect the bug, the patch in 2.4.67, and what defenders should actually do.

A buffer overflow in the PAN-OS User-ID Authentication Portal lets unauthenticated attackers execute code as root on PA-Series and VM-Series firewalls. Palo Alto confirmed in-the-wild exploitation and CISA added it to KEV before patches shipped.