Nginx Leaves Dynamic Tables Unused in HTTP/2 and HTTP/3 Responses
Nginx applies header compression asymmetrically in both HTTP/2 and HTTP/3. While clients compress repeated headers after the first transmission, the server always emits full literals, keeping response header sizes constant regardless of repetition count.
Measurements on a minimal stand with four identical requests show server responses locked at 131 bytes under HTTP/3 and 129 bytes under HTTP/2. Client requests, by contrast, drop from 246 bytes to 8 bytes once the dynamic table is populated.
Inspection of release-1.31.3 reveals the root cause inside ngx_http_v3_filter_module.c: all twenty-two invocations of ngx_http_v3_encode_field_ri and ngx_http_v3_encode_field_lri pass a zero value for the dynamic flag, forcing every field to be encoded as a literal. The field-section prefix is likewise emitted with insert_count and delta_base set to zero. No server-side encoder stream of type 0x02 is ever opened.
The identical limitation exists in the HPACK implementation. The HTTP/2 filter module contains zero references to ngx_http_v2_hpack_t and explicitly sends a Dynamic Table Size Update of zero on the first HEADERS frame, disabling client-side table usage for server responses.
The receiving path, however, is fully functional. ngx_http_v3_table.c implements insertion, eviction, blocked-stream tracking and the default 4096-byte table capacity announced in the SETTINGS frame. Debug logs confirm that client-supplied headers are correctly inserted and later referenced by index.
The asymmetry is explicitly allowed by RFC 9204 §4.2, yet it eliminates the compression gains that motivated the introduction of QPACK and HPACK. The unused encoder code path also contributed to a use-after-free vulnerability (CVSS 9.2) in the QPACK decoder earlier this year.
Related articles
CISA Adds Seven Exploited Vulnerabilities in SonicWall, JFrog and Kestra to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added seven known exploited vulnerabilities affecting SonicWall SMA1000, JFrog Artifactory and Kestra OSS products to its KEV catalog. Five of the flaws carry a three-day remediation deadline for federal agencies. Two issues in SonicWall SMA1000 enable unauthenticated server-side request forgery and authenticated OS command execution. A critical authentication bypass in JFrog Artifactory allows remote attackers to obtain administrative privileges. Kestra OSS is affected by an OS command injection vulnerability that can lead to full system compromise. CISA urges immediate patching and incident response actions.
Cisco Issues Security Updates for IOS XR Fixing Multiple Critical Vulnerabilities
Cisco Systems has released security updates for its network operating system Cisco IOS XR to address multiple vulnerabilities discovered through internal research. The update, published on September 2, 2026, classifies the flaws into seven categories, each assigned distinct CVE identifiers. Two vulnerabilities, CVE-2026-20274 and CVE-2026-20279, received the highest CVSS v3.1 base score of 9.8 and are rated Critical. Additional issues include command injection flaws rated 8.8 and other weaknesses scoring between 8.2 and 8.6. No exploitation has been observed at the time of disclosure. Cisco is distributing Software Maintenance Updates and plans to include fixes in upcoming releases 26.3.1 and 26.2.2.
Telegram Desktop Bug Deletes Up to 800 GB of User Data on Windows Due to Spellcheck Library Error
A critical configuration flaw in Telegram Desktop for Windows caused the application to recursively delete the entire contents of the C:\custom directory, resulting in the loss of approximately 800 GB of user data including programs, projects, and personal files. The issue originated in the lib_spellcheck library introduced in version 7.1.0, where an empty working directory path was concatenated with /custom and resolved by Qt into an absolute system path. Instead of locating a dictionary file, the code invoked removeRecursively() on the discovered directory, systematically erasing all accessible files while leaving folder structures intact. The bug affected only Windows builds with the built-in spellchecker enabled and remained in distribution for roughly 66 hours across versions 7.1.0 and 7.1.1. Researchers confirmed the behavior using Process Monitor logs and reported it via ticket #31170, prompting developers to add path validation before the function call and disable dictionary operations on empty paths. The corrected code was released in Telegram Desktop 7.1.2, and users running the vulnerable versions are advised to update immediately. No impact was observed on Linux or macOS platforms.
Essential Active Directory Checks Before Launching Any Penetration Test
Internal penetration tests of Active Directory can quickly generate noise in logs or disrupt services if techniques are applied without proper context. The article stresses that testers must first map domain boundaries, identify controllers, clarify allowed segments, and establish escalation procedures with the client. Detailed inventory of user, service, and privileged accounts is required, including analysis of Kerberos pre-authentication settings that enable AS-REP Roasting. Testers should also examine DACL permissions, delegation relationships, and Active Directory Certificate Services templates before attempting any exploitation. The guidance covers NTLM relay risks, the importance of maintaining an action log, and the distinction between standard pentests and Red Team engagements. A demo version of the Red September course on Active Directory attacks is offered to practice these steps in a controlled environment.