Multiple Vulnerabilities Disclosed in HackerOne Bug Bounty Reports

• •Multiple vulnerabilities reported on September 7, 2026, through HackerOne.
• •Issues include use-after-free and HTTP upload offset consumption vulnerabilities.
• •No confirmed exploitation in the wild, but potential for future risks.

On September 7, 2026, several vulnerabilities were reported through HackerOne, affecting HTTP/2 and HTTP upload functionalities. The vulnerabilities include a use-after-free issue caused by rejected HTTP/2 pushes, and a problem where the HTTP upload resume offset is consumed twice after an early redirect. The affected systems are primarily those utilizing HTTP/2 protocols. The vulnerabilities were submitted by a user named Anteater. The severity and impact of these vulnerabilities could lead to potential exploitation if not addressed. Currently, there are no confirmed exploits in the wild, and the vulnerabilities are disclosed but not yet patched. Security professionals are advised to monitor for updates and implement recommended fixes as they become available.