EUVD-2026-80315

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses...

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

Impact fastify crashes with an uncaught ERRHTTP2INVALIDCONNECTIONHEADERS exception when a route that registers a response trailer via reply.trailer is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

Metasploitable-2-Distcc-Exploit-via-Kali-Linux-CVE-2004-2687

🎬 이 YouTube 동영상 1️⃣ 타겟 식별 Nmap nmap -sV -p 3632 192.168.56.102 ✅ 결과는 다음과 같습니다: 3632/tcp open distccd v1 👉 즉, distcc가 열려 있으며 악용할 수 있습니다. 2️⃣ Metasploit 실행 msfconsole 3️⃣ Distcc 익스플로잇 선택 use exploit/unix/misc/distccexec 4️⃣ 설정 확인 show options 필요한 매개변수: 옵션 값 RHOSTS Metasploitable IP RPORT 3632 PAYLOAD...

CLEANSTART-2026-TQ18292 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the crane package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2023-VW60139 In AdvanceCOMP 2

Security vulnerability affects the advancecomp package. In AdvanceCOMP 2...

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy. The HTTP/2 path builds a session with...

EUVD-2026-88367

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls...

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...

GHSA-542G-H47M-68V8 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...

NPM: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

NPM: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Summary nodemailer/lib/addressparser parses one shape of address in On^2 time. A single 640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to...

CitrixBleed-2-CVE-2025-5777-PoC-

CitrixBleed 2 CVE-2025-5777 궁극 분석 NetScaler ADC / Gateway의 Out-of-Bounds Memory Read — 원인부터 공방 실전까지의 전방위 매뉴얼 PoC 사용법: python3 poc.py https://gateway.example.com Exp 사용법: python3 exp.py https://gateway.example.com admin 7acbb35f4d... 목차 0x00 引言 / 速览 0x01 背景：NetScaler 架构与 CitrixBleed 1 回顾 0x02...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 CVE-2025-54236 "SessionReaper"를 위한 통합 PoC, Magento 2 / Adobe Commerce의 REST API에서 중첩 역직렬화를 통한 중요한 인증되지 않은 RCE입니다. CVSS: 9.1 심각 근본 원인: 부적절한 입력 검증 CWE-20; 익스플로잇 기본 요소는 안전하지 않은 역직렬화 CWE-502 최초 연구자: Daniel "Blaklis" Le Gall HackerOne을 통한 책임 공개 명명자: Sansec 수정 버전: Adobe...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.49 security and extras update

Red Hat OpenShift Container Platform release 4.19.49 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

CVE-2025-31650

Apache Tomcat 10.1.39 - 서비스 거부 DoS 이 도구는 비정상적인 priority 헤더를 사용하여 대량의 비동기 HTTP/2 요청 플러드를 수행하여 Apache Tomcat 서버버전 10.1.1010.1.39의 안정성을 테스트합니다. ⚠️ 이는 교육 및 연구 목적 으로만 엄격히 사용됩니다. ❌ 저자는 불법적이거나 승인되지 않은 사용에 대해 책임을 지지 않습니다. 🧰 기능 비정상적인 HTTP/2 priority 헤더를 무작위로 전송 멀티스레드 비동기 아키텍처 httpx 실시간 가용성 모니터링 속성, CVE 또는...

cve-2023-44487

CVE-2023-44487 HTTP/2 Rapid Reset 이 저장소에는 영향을 분석하기 위해 완전히 테스트되지 않은 몇 가지 예제가 있지만, 저는 단지 이 공격의 개념 starting many streams and immediately sending RSTSTREAM frame to avoid reaching MAXCONCURRENTSTREAMS을 수행하고 싶었습니다. H2SpaceX 저는 Single Packet Attack을 악용하기 위해 제가 만든 저수준 HTTP/2 라이브러리인 H2SpaceX를 사용합니다. 예제 2...

AlmaLinux 9.2 [TuxCare] Security Update: mod_auth_openidc (ALMALINUX9.2:CLSA-2025:1753800294)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753800294 advisory. - modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 ar...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2024:1715280815)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1715280815 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...