38214 matches found
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
WebGoat.NET
Webgoat.NET Source Code: https://github.com/jerryhoff/WebGoat.NET Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master このWebアプリケーションは、一般的なWebセキュリティの欠陥について教えることを目的とした学習プラットフォームです。 ほとんどのWebアプリケーションに当てはまる汎用的なセキュリティ欠陥が含まれています。また、 .NETフレームワークに特化したレッスンも含まれています。このアプリの演習は、...
CVE-2026-46331
PACKETEDITMEME - CVE-2026-46331 net/sched actpedit の部分 COW ページキャッシュ破損（原因コミット 899ee91156e5、v5.18 で存在、v7.1-rc7 で修正）。packeteditmeme.c はこれを非特権ユーザーによるローカル root 取得に利用します：userns 内で CAPNETADMIN を持つ子プロセスが、setuid-root バイナリのキャッシュ済み ELF メタデータを setgid0+setuid0+execve"/bin/sh" シェルコードで上書きします。 root@kitploit: mak...
cve-2026-46331-audit
cve-2026-46331-audit Read-only audit script for CVE-2026-46331 a.k.a. pedit COW — a partial copy-on-write bug in the Linux kernel's net/sched actpedit action that lets a local unprivileged user corrupt page cache memory and escalate to root. root@kitploit: | | | \ | | / / \ \ / / | | | | | | | | ...
CVE-2026-74766
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...
CVE-2026-87080
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...
CVE-2026-87079
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...
CVE-2026-87081
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...
CVE-2026-87082
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encodepunycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from an...
CVE-2026-74765
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no overflow check, so...
CVE-2026-87078
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path...
CVE-2016-15059
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...
UBUNTU-CVE-2026-87079
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...
UBUNTU-CVE-2026-74765
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no overflow check, so...
UBUNTU-CVE-2026-87082
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encodepunycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from an...
UBUNTU-CVE-2026-87078
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path...
UBUNTU-CVE-2026-87080
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...
UBUNTU-CVE-2016-15059
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...
UBUNTU-CVE-2026-74766
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...