Nginx Leaves Dynamic Tables Unused in HTTP/2 and HTTP/3 Responses
Nginx applies header compression asymmetrically in both HTTP/2 and HTTP/3. While clients compress repeated headers after the first transmission, the server always emits full literals, keeping response header sizes constant regardless of repetition count.
Measurements on a minimal stand with four identical requests show server responses locked at 131 bytes under HTTP/3 and 129 bytes under HTTP/2. Client requests, by contrast, drop from 246 bytes to 8 bytes once the dynamic table is populated.
Inspection of release-1.31.3 reveals the root cause inside ngx_http_v3_filter_module.c: all twenty-two invocations of ngx_http_v3_encode_field_ri and ngx_http_v3_encode_field_lri pass a zero value for the dynamic flag, forcing every field to be encoded as a literal. The field-section prefix is likewise emitted with insert_count and delta_base set to zero. No server-side encoder stream of type 0x02 is ever opened.
The identical limitation exists in the HPACK implementation. The HTTP/2 filter module contains zero references to ngx_http_v2_hpack_t and explicitly sends a Dynamic Table Size Update of zero on the first HEADERS frame, disabling client-side table usage for server responses.
The receiving path, however, is fully functional. ngx_http_v3_table.c implements insertion, eviction, blocked-stream tracking and the default 4096-byte table capacity announced in the SETTINGS frame. Debug logs confirm that client-supplied headers are correctly inserted and later referenced by index.
The asymmetry is explicitly allowed by RFC 9204 §4.2, yet it eliminates the compression gains that motivated the introduction of QPACK and HPACK. The unused encoder code path also contributed to a use-after-free vulnerability (CVSS 9.2) in the QPACK decoder earlier this year.
Related articles
Docker Bypasses UFW Firewall Exposing PostgreSQL and Redis Ports to Rapid Malware Infections
A common Docker Compose setup with exposed database ports on fresh VPS instances allows attackers to compromise systems within minutes despite active UFW rules. Docker's use of DNAT rules in the PREROUTING chain and insertion of DOCKER-FORWARD chains before UFW rules in the FORWARD table routes external traffic directly to containers on internal bridge networks. IPv6 support in Docker versions 27 and later creates additional exposure vectors when administrators focus only on IPv4 protections or disable IPv6 filtering. Bots scan cloud IP ranges for open ports including 5432 and 6379, deploying miners such as kdevtmpfsi and kinsing or using Redis replication to load malicious modules. Historical cases include a Qdrant test instance on Hetzner compromised in under two minutes and similar issues reported in Spree Commerce starter templates. The article details Netfilter mechanics, protected-mode limitations in Redis, and specific exploitation techniques like CONFIG SET for cron jobs and CVE-2022-0543 Lua sandbox escapes.
WordPress 7.1.4 Addresses RCE in Update Process and Multiple Stored XSS Vulnerabilities
The WordPress development team released version 7.1.4 on October 28, 2026, as a security update to resolve several vulnerabilities. The most severe issue allows remote code execution during the software upgrade process. Multiple stored cross-site scripting flaws were also fixed, including those triggered by specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the advisory. Site administrators are strongly urged to apply the update immediately to prevent potential exploitation. The announcement was reported by Security NEXT on November 2, 2026.
CISA Adds Two Ivanti Connect Secure Flaws to KEV Catalog After Confirmed Exploitation
US authorities have issued an alert after confirmed exploitation of two vulnerabilities in Ivanti Connect Secure (ICS). The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were added to CISA’s Known Exploited Vulnerabilities Catalog on October 30, 2026. Attacks combining three vulnerabilities have also been observed in the wild. CVE-2026-111357 allows local authenticated attackers to escalate privileges due to missing authentication in a critical function. CVE-2026-118527 enables remote upload of arbitrary files to disk through predictable identifiers, even though authentication is required. The addition of CVE-2026-111357 was briefly withdrawn before being reinstated, highlighting administrative confusion around the listing.
Enodia: Open-Source Go Tool Automates Service Inventory, EOL Tracking and CVE Correlation
A DevOps engineer has released enodia, a single-binary Go CLI that discovers real versions of services across large heterogeneous environments and correlates them with end-of-life calendars and vulnerability databases. The tool was built after manual Ansible-based inventories and existing solutions such as endoflife.date, nvchecker, Renovate and Uptime Kuma proved insufficient for covering both infrastructure and application services while also providing actionable lifecycle, patch and branch status. Enodia uses product-specific probes for 123 technologies including PostgreSQL, MySQL, MariaDB, Jira, Confluence, Bitbucket, VMware vCenter, ESXi, pfSense and multiple Linux distributions, falling back to a generic URL-plus-regex probe when needed. Data collection is deliberately separated from evaluation so that inventory.jsonl files can be generated inside air-gapped networks and later analysed where CVE feeds are available. The project also contributed dozens of missing products and corrected EOL dates to the endoflife.date project and integrates both NVD and Russia’s FSTEC BDU vulnerability databases. Special handling was added for MySQL/MariaDB connection-error counters, version-string masquerading, and vendor-specific update nomenclature to avoid false reports.